PHP maintainers schedule patches for two 9.2-rated vulnerabilities amid leaked exploit tool

PHP maintainers announced on Monday that they intend to publish fixes for two severe vulnerabilities in the programming language within approximately twelve hours. The advisory urges all users to prepare their systems for an immediate upgrade once the updates become available.

The two flaws, identified as CVE-2026-109618 and CVE-2026-109619, carry severity scores of 9.2 out of 10. The team stated they may release the patches earlier than scheduled if public details emerge or if evidence of active exploitation appears. The decision to accelerate the timeline follows the leak of purported exploit details that have not yet been independently verified.

The Leaked Exploit Tool

An unconfirmed report circulated with a video demonstrating a tool named PHP2Shell. The footage showed the tool executing remote code on servers running various PHP-based applications. The demonstration included WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, and Joomla 6.2.0.

The video also depicted successful execution on Laravel 13.36.0, Laravel 8.83.29, Symphony 8.1.9, Drupal 11.4.10, and WHMCS 9.0.9. While investigators could not locate the original unconfirmed report, security firm watchTowr confirmed the vulnerabilities are real and stated the issues affect all PHP versions from PHP 5 onward.

Impact and Industry Response

Security researchers from Sansec expect mass attacks to commence within fifteen minutes of the patch release. Webfence and Huntress also issued advisories urging administrators to prepare immediately. One researcher estimated that approximately 1.3 million Internet-connected hosts are likely vulnerable to these flaws.

PHP serves as a foundational technology for many dynamic websites and internal tools. Its widespread use across content management systems and web applications means the potential impact of these vulnerabilities is extensive. The maintainers emphasized the need for readiness due to the scale of the affected user base.

What should you do?

Administrators should identify the personnel responsible for managing PHP within their organizations. Teams are advised to take a complete inventory of every application built on the language to assess exposure. Planning a maintenance window starting at 14:00 UTC is recommended, with contingency plans for an earlier release.

Creating backups of site and database files is essential before applying any updates. Organizations should monitor the PHP.net homepage for late-breaking announcements, including changes to the release time. Some experts suggest disconnecting non-essential systems from the network until they are patched.

What to do and how to stay safe: PHP

• Inventory all internal and external applications running on PHP to determine which versions require updating.
• Schedule a maintenance window at 14:00 UTC and prepare for an earlier deployment if the vendor accelerates the release.
• Create full backups of all website files and databases before attempting to apply any security patches.
• Monitor official PHP channels for updates and consider isolating non-critical systems from the network until patched.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which CVEs are associated with these PHP vulnerabilities?

The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619.

What is the severity rating of these flaws?

Both vulnerabilities have a severity rating of 9.2 out of 10.

Is there evidence that these vulnerabilities are being exploited?

Details are unconfirmed, but the maintainers reserved the right to release patches early if evidence of active exploitation appears.