PHP Patches 2 Critical Flaws Rated 9.2 After Exploit Leak

PHP maintainers released emergency patches for two vulnerabilities rated 9.2 out of 10 in severity after details of an exploit leaked online, according to Ars Technica. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619.

What Did PHP Maintainers Warn About?

Maintainers posted an advisory Monday telling administrators to prepare for a patch release. "All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available," the advisory stated, per Ars Technica. Maintainers said they reserved the right to release early if exploit details became public or active attacks appeared.

What Is PHP2Shell?

An unconfirmed report surfaced showing a video of an exploit tool called PHP2Shell executing code on servers running PHP-based software. Ars Technica said attempts to locate the original report were unsuccessful. Security firm watchTowr said the report claimed the flaw affects every PHP version since PHP 5, which launched in 2004. WatchTowr told Ars Technica it confirmed the vulnerabilities are real.

Timeline of the Patch Release

October 20, 2026 — PHP maintainers publish an advisory warning of an imminent release of two patches rated 9.2 in severity, after leaked, unconfirmed exploit details circulate online, Ars Technica reported.

Same day — Security firm Sansec says it expects "mass attacks to start within 15 minutes of the release," according to Ars Technica. Security firms Webfence and Huntress issue their own advisories urging admins to prepare.

October 21, 2026, 13:34 UTC — Source fixes land in the php-src GitHub repository, Ars Technica reported in an update to its story. Advisories accompany the commits.

Following hours — Packages and Docker images begin updating as maintainers finalize distribution of the new source code, per the outlet's update.

Which Platforms Are Affected?

The leaked video reportedly showed the PHP2Shell tool executing code on servers running WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symphony 8.1.9, Drupal 11.4.10 and WHMCS 9.0.9, according to Ars Technica. All of those platforms run on PHP, which the outlet describes as a de facto building block for the web. One researcher cited by Ars Technica estimated 1.3 million internet-connected hosts are likely affected.

What Should Site Admins Do Now?

Ars Technica's advice, drawn from security researchers: identify who manages PHP inside an organization, inventory every application built on the language, and schedule a maintenance window starting at 14:00 UTC with a contingency plan to move earlier. Admins should back up site and database files before patching and monitor the PHP.net homepage for release announcements. Some experts suggested unplugging nonessential systems until patches are applied. With fixes now committed to the php-src repository and packages rolling out, Ars Technica's updated guidance is unchanged: update as soon as possible.