The developers of the PHP programming language announced plans to release urgent security updates to address two extremely severe security vulnerabilities, each holding a severity score of 9.2 out of 10 possible points. This warning, directed at website administrators and global web networks, comes amid unconfirmed reports discussing the leakage of technical details and an exploit tool named PHP2Shell.
The official alert indicated that maintainers reserve the right to release the patches earlier if details of the two vulnerabilities are publicly shared or if any evidence of active exploitation in the wild is detected. These data points have prompted several cybersecurity companies, such as watchTowr, Sansec, Webfence, and Huntress, to issue urgent warnings urging administrators to raise immediate preparedness and prepare for update operations as soon as they are released.
Details of the Expected Threat
A leaked video, which has not yet been officially verified, demonstrated an exploit tool called PHP2Shell capable of remote code execution on web servers that include popular platforms and systems such as WordPress (WordPress 7.1.3), MediaWiki (MediaWiki 1.46.2), phpBB (phpBB 3.3.17), Magento (Magento 2.4.9), Joomla (Joomla 6.2.0), Laravel, Drupal (Drupal 11.4.10), and other platforms relying on the PHP language.
For its part, cybersecurity firm watchTowr confirmed that the two vulnerabilities bear the identifiers CVE-2026-109618 and CVE-2026-109619, that they are real, and that they affect all PHP versions starting from version 5 released in 2004 onwards. In the same context, researchers from Sansec predicted that large-scale attacks would begin within mere minutes of the official release of the patches.
What Changes Practically for Organizations?
PHP is considered the cornerstone of many web applications and content management systems around the world, with estimates indicating that approximately 1.3 million internet-connected hosts are affected. Therefore, experts provided a set of proactive steps for administrators, including:
- Identifying the entity responsible for managing PHP within the organization.
- Preparing a comprehensive inventory of all applications and systems built on the language.
- Planning an urgent maintenance window with contingency plans for early intervention.
- Creating complete backups of website files and databases.
- Continuously monitoring the official PHP.net page for any updates or early announcements.
Given the high level of vulnerability severity and the potential damage on a wide scale across the internet, it is advised to remain in a state of complete vigilance and follow security developments until official patches are available and applied immediately.