PHP warns it plans to release 2 emergency patches imminently
ars ·
PHP maintainers have announced that they plan to release two emergency security patches imminently, addressing vulnerabilities rated with a severity of 9.2 out of 10. The advisory urges all users to prepare for immediate upgrades, reserving the right to release the fixes earlier if details become public or active exploitation is detected. This warning follows unconfirmed reports and video evidence of an exploit tool named PHP2Shell executing code on various popular web applications like WordPress and Drupal. Security firm watchTowr claims the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, affect every PHP version from 5 onward. Other security researchers, including those from Sansec and Webfence, expect mass attacks to begin shortly after the patch release. Administrators are advised to inventory their systems, create backups, and monitor official channels for updates. Experts estimate that approximately 1.3 million internet-connected hosts may be affected by these critical flaws.
ars