Glonce

PHP maintainers plan patches for two severe flaws, tell admins to prepare

securityThe Glonce editorsArs Technica🔥75Glonce rating75Impact78Novelty70Relevance85Surprise70Players35Credibility75
PHP maintainers plan patches for two severe flaws, tell admins to prepare

PHP maintainers said on Monday that they plan to release patches for two vulnerabilities, both with severity ratings of 9.2 out of a possible 10. Per Ars Technica, the fixes were scheduled to arrive in a little more than 12 hours from the time of writing. PHP is the programming language behind websites and web applications everywhere, and the vulnerabilities are believed to be uncommonly severe.

The advisory tells users what to do ahead of time: "All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available." It also keeps the option of moving sooner: "We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild."

The maintainers published the advisory after purported details of the flaws leaked. Those details have yet to be confirmed. The leaked report included a video of an exploit tool dubbed PHP2Shell executing code on webservers running WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symphony 8.1.9, Drupal 11.4.10 and WHMCS 9.0.9. All of these applications use PHP.

The Ars Technica author tried to locate the unconfirmed report and could not. Security firm watchTowr said the report claimed to affect every PHP version from PHP 5, released in 2004, onward. watchTowr went on to say it has confirmed that the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are real.

Key facts

  • PHP maintainers said on Monday they plan to release patches for two vulnerabilities, each rated 9.2 out of 10, in a little more than 12 hours.
  • The advisory urges all PHP users to prepare now so they can upgrade as soon as the release is available, and reserves the right to release earlier.
  • A leaked, unconfirmed report showed a video of an exploit tool called PHP2Shell executing code on webservers running ten listed PHP applications, including WordPress 7.1.3, Drupal 11.4.10 and Magento 2.4.9.
  • watchTowr says it has confirmed the vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are real; the claim that every version from PHP 5 onward is affected comes from the unconfirmed report.

Why it matters

PHP powers websites and web applications everywhere, so a pair of flaws that the maintainers rate 9.2 out of 10 and that are believed to be uncommonly severe is a big deal for a lot of the web. The maintainers chose to publish an advance advisory instead of a quiet release, and told users to get ready before the fixes land. The advisory followed the leaking of purported details, which have yet to be confirmed.

Who it affects

Anyone who runs PHP, which the article describes as a language that powers websites and Web applications everywhere. The leaked video allegedly showed PHP2Shell running code on webservers with WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symphony 8.1.9, Drupal 11.4.10 and WHMCS 9.0.9. The unconfirmed report reportedly claimed every PHP version from PHP 5 onward is affected, but that claim is not confirmed by the source.

How to use it

Follow the advisory: prepare now so you can upgrade as soon as the release is available. In practice that means website admins should be ready to apply the PHP update when it appears, since the maintainers say they may release earlier if details become public or exploitation appears in the wild. The CVE identifiers to watch for are CVE-2026-109618 and CVE-2026-109619.

How solid is it

The advisory itself comes from the PHP maintainers, and the planned patches and the 9.2 ratings are their statement. The leaked details are purported and have yet to be confirmed, and the author could not locate the report. watchTowr, a security firm, says it has confirmed that the two vulnerabilities are real. The source does not say which PHP versions that confirmation covers; the claim about every version from PHP 5 onward is attributed to the unconfirmed report.

Risks and caveats

The nature of the vulnerabilities (type of bug, attack vector, whether remote and unauthenticated) is not described. The exact release time of the patches and the PHP version numbers that will contain them are not given. No evidence of active exploitation in the wild is reported. The source does not say whether the 9.2 rating is CVSS or which version of a scoring system. Because the maintainers reserve the right to release early, the timing could shift.

“All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available”

— PHP maintainers, in the advisory