PHP to release emergency patches for critical vulnerabilities

Summarised from 3 outlets · Updated 21 Oct, 13:03 · Archive

PHP maintainers plan to release patches for two critical vulnerabilities rated 9.2 out of 10 in severity.

PHP maintainers announced plans to release emergency patches for two critical vulnerabilities within approximately 12 hours, both rated 9.2 out of 10 in severity. The advisory urged all PHP users to prepare to upgrade immediately upon release, with maintainers reserving the right to release patches earlier if vulnerability details become public or evidence of active exploitation emerges.

An unconfirmed report claimed the vulnerabilities enable remote code execution through an exploit tool called PHP2Shell. Security firm watchTowr confirmed the vulnerabilities are real and affect all PHP versions from PHP 5 (released in 2004) onwards, with the vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. Security researchers from Sansec said they expect mass attacks to begin within 15 minutes of release, while other security firms including Webfence and Huntress urged administrators to prepare immediately.

Administrators are advised to identify PHP management responsibilities within their organisations, inventory all applications using PHP, plan a maintenance window starting at 14:00 UTC with earlier contingencies, back up site and database files, and monitor the PHP.net homepage for announcements about any earlier release time.

PHP to release emergency patches for critical vulnerabilities — Image: BBC Technology

Comments (0)

How it is being reported

Cyber chiefs tell websites to make critical safety update or go offlineTwo critical vulnerabilities have been identified with PHP, a programming language which is widely used across the internet.BBC Technology · 21 Oct, 13:14
A critical PHP vulnerability may take websites down todaySecurity patches for the PHP programming language, widely used to build websites and web apps, are expected to roll out today, with the goal of fixing two critical vulnerabilities that could wreak havoc on the internet if left unchecked. In an advisory published on Tuesday, PHP developers said the vulnerabilities have a severity rating of […]The Verge · 21 Oct, 12:49
PHP warns it plans to release 2 emergency patches imminentlyUnconfirmed report claims PHP2Shell exploit remotely executes code on PHP sites.Ars Technica · 21 Oct, 03:12

In this story: PHP · watchTowr · Sansec · Webfence · Huntress

This summary was written by AI from the headlines and standfirsts above, and states as fact only what at least two outlets report. How we use AI · Report a problem