Website administrators, shut up. Fixes for what is believed to be an unusually severe vulnerability are scheduled to drop in a little more than 12 hours for PHP, a programming language that powers websites and web applications everywhere.
PHP maintainers said Monday that they planned to release patches for two vulnerabilities, both with severity ratings of 9.2 out of a possible 10.
Waiting for PHP2Shell
“All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available,” the advisory said. “We reserve the right to publish earlier if the details of either vulnerability become public, or should evidence of active exploitation appear in the wild.”
The maintainers published the advice after the leak of alleged details, which are yet to be confirmed. The report showed a video of an exploit tool called PHP2Shell executing code on web servers running WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 9.19.8. 11.4.10, and WHMCS 9.0.9, which all use PHP. A video demonstrating the tool has been reposted here.
Attempts to locate the unconfirmed report were unsuccessful, but security firm watchTowr said it claimed to affect all PHP versions since PHP 5, which was released in 2004. The security company went on to say that it has confirmed that the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are real.