Patch PHP servers now to block remote code execution via two severe flaws
Maintainers warn of imminent fixes for two 9.2-rated vulnerabilities after an exploit tool leak, urging immediate preparation for updates.
Key points
- PHP maintainers scheduled patches for two 9.2-rated vulnerabilities, CVE-2026-109618 and CVE-2026-109619.
- A leaked exploit tool named PHP2Shell demonstrated remote code execution on various PHP-based applications.
- Security firms confirmed the vulnerabilities are real and expect mass attacks shortly after the patches release.
PHP maintainers announced on Monday that they will release patches for two severe vulnerabilities, both rated 9.2 out of 10, in approximately 12 hours. The advisory urges all users to prepare for immediate upgrades to mitigate the risk of remote code execution on their servers.
The maintainers issued the warning after details of an exploit tool called PHP2Shell were leaked. A video associated with the leak showed the tool executing code on servers running various popular applications built with PHP, including WordPress, Drupal, and Magento.
Context and Background
Security firm watchTowr confirmed that the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are genuine. According to watchTowr, the flaws affect every PHP version released since 2004, meaning a vast number of legacy and modern systems are potentially vulnerable.
Researchers from Sansec stated they expect mass attacks to begin within 15 minutes of the patch release. Other security firms, including Webfence and Huntress, have also issued advisories urging administrators to prepare their infrastructure for the update.
Who Is Affected
The leaked report indicated that the exploit could target a wide range of applications. The demonstration video showed successful execution on WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symphony 8.1.9, Drupal 11.4.10, and WHMCS 9.0.9.
One security researcher estimated that approximately 1.3 million Internet-connected hosts are likely affected by these vulnerabilities. Because PHP powers many internal tools and dynamic websites, the potential impact extends beyond public-facing content management systems to various web applications.
What to watch
Maintainers reserved the right to release the patches earlier if details become public or evidence of active exploitation appears. Administrators should monitor the PHP.net homepage for late-breaking announcements regarding changes to the release schedule.
Preparation steps outlined by experts include identifying who manages PHP within the organization and taking an inventory of all applications built on the language. Teams should plan a maintenance window starting at 14:00 UTC, with contingency plans for an earlier release.
Creating backups of site and database files is essential before applying updates. Some experts suggest unplugging non-essential systems from the network until they are patched to reduce exposure during the initial wave of potential attacks.
What made it possible
This incident highlights the risk of remote code execution flaws in foundational web technologies. Attackers typically exploit such weaknesses to gain initial access to a server without authentication. The vulnerability likely stems from how the language processes input, allowing malicious commands to run with the privileges of the web server. Teams usually monitor for unusual outbound traffic or new shell accounts to detect such intrusions early.
What to do and how to stay safe: PHP
- Identify all systems running PHP and determine their current version to assess exposure.
- Schedule a maintenance window for the patch release and prepare rollback procedures.
- Back up all website files and databases before applying any updates.
- Monitor security advisories for signs of active exploitation or changes to the release time.
Step-by-step guide: How Security Advisories Drive Patch Decisions and Reduce Risk
General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which CVE IDs are associated with these PHP vulnerabilities?
The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619, according to security firm watchTowr.
When are the patches expected to be released?
PHP maintainers scheduled the release for approximately 12 hours after their Monday advisory, though they may release earlier if exploitation is detected.
What applications were shown to be vulnerable in the leak?
The leak demonstrated exploitation on WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symphony, Drupal, and WHMCS, all of which use PHP.
