Details of two critical security vulnerabilities in the PHP programming language have leaked online, coinciding with preparations to disclose them under coordinated disclosure schedules and before official updates were fully available to users. The vulnerabilities carry the identifiers CVE-2026-109618 and CVE-2026-109619, both holding a critical severity rating of 9.2 on the CVSS scale, making them susceptible to potential exploitation without requiring authentication, according to warnings from the Computer Emergency Response Team for the European Union (CERT-EU).
Technical reports have named these vulnerabilities PHP2Shell, pointing to the potential ability of attackers to exploit them to gain command execution privileges (shell) on compromised servers. Initial estimates indicate that all PHP versions starting from version 5 (PHP 5) onwards may be affected by these software flaws.
Emergency Preparations and Security Firm Confirmations
Following the leak, PHP rushed to issue warnings urging all users to prepare to apply updates as soon as they become available, with the possibility of releasing patches early if evidence of exploitation in live environments emerges. Meanwhile, exposure management company WatchTowr confirmed it successfully reproduced vulnerability CVE-2026-109618, limiting itself to confirming the existence of the flaw without publishing precise technical details for security reasons.
Although immediate active attacks were not initially observed by WatchTowr and Huntress, cybersecurity firm Sansec warned of the likelihood that automated exploitation attempts could begin within minutes of patches being released. Subsequently, PHP released the necessary updates, coinciding with cybersecurity firms detecting actual exploitation attempts, some of which were recorded even before the fixes reached the targeted servers.
Why This News Matters
This development poses a severe risk because PHP serves as the backbone for powering a massive percentage of websites and servers worldwide. Unauthenticated remote code execution (RCE) vulnerabilities allow hackers to take complete control of compromised infrastructure. Furthermore, the event highlights ongoing challenges in vulnerability management when technical details are leaked publicly before patches are available, placing tremendous pressure on security teams to apply updates at record speed to avoid widespread automated attacks.