PHP Maintainers Warn of Two Emergency Security Patches Due Within Hours
The maintainers of the PHP programming language say they will release fixes in about 12 hours for two vulnerabilities, each rated 9.2 out of 10 for severity. Website administrators are urged to prepare to update.
The maintainers of PHP, the programming language behind a large share of websites and web applications, announced on Monday that they will release patches for two security vulnerabilities in a little more than 12 hours. Both flaws carry a severity rating of 9.2 out of a possible 10.
"All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available," the advisory said. The maintainers added that they reserve the right to publish the fixes sooner if details of either flaw become public or if evidence of active exploitation appears in the wild.
What prompted the advisory
The advisory followed the leak of purported details about the vulnerabilities, which have not been confirmed. The leaked report included a video of an exploit tool called PHP2Shell running code on web servers that use PHP-based software: WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symphony 8.1.9, Drupal 11.4.10 and WHMCS 9.0.9.
Attempts to locate the report itself were unsuccessful. The security firm watchTowr said the report claimed the flaws affect every PHP version since PHP 5, which was released in 2004.
Confirmation
watchTowr also said it has confirmed that the vulnerabilities are real. They are tracked as CVE-2026-109618 and CVE-2026-109619.
