The PHP security team will release emergency fixes today, October 21, 2026, at 14:00 UTC for two critical remote code execution vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 under CVSS v4.0, and the pair has been nicknamed PHP2Shell. The flaws could let an attacker run their own code on a vulnerable server over the internet, which can lead to stolen data, defaced sites or a complete takeover. The warning matters for the whole web, as PHP powers nearly 70% of websites with a known server-side programming language.
How the Details Leaked Before the Patch
The PHP team published an advance notice on October 20, urging all users to prepare to upgrade the moment the release lands. It said it would not disclose technical details about affected versions, or fixed versions until the release itself. It also reserved the right to ship early if details became public or if attacks appeared in the wild. That caveat turned out to matter, because information about the embargoed bugs reportedly leaked ahead of the planned disclosure.
Security firm WatchTowr posted on X and confirmed that the flaws are real remote code execution bugs, and its CEO, Benjamin Harris, told the company had reproduced CVE-2026-109618. A screenshot of an exploit tool called PHP2Shell, credited to Calif.IO, has also circulated. As of Tuesday, there was no evidence of large-scale exploitation, though a video online appeared to show someone using the exploit.
Which PHP Versions and Websites Are Affected
PHP has not confirmed which versions are affected. Sansec, a Dutch e-commerce security firm, says the bugs hit every web server running PHP 5.4 or later, a claim based on the banner of the leaked tool. watchTowr believes versions 5 through 8 are exposed, and Aikido advises treating every version as vulnerable until the official list appears. Either way, the exposure reaches WordPress, WooCommerce, Drupal, Joomla, Magento, Shopware, MediaWiki and Laravel applications. Sites on PHP 8.1 or older face an extra problem. PHP supports only the 8.2 branch and later, so older installations will not receive an official fix and need to move to a supported release.
What Researchers Suspect Is Behind the Flaws
Researchers have begun to point at a likely location for the flaws. Several reports tie at least one of them to PHP’s session upload progress feature, which has been enabled by default since PHP 5.4, and describe a memory corruption bug in the code that handles multipart uploads. PHP has not confirmed any of this, so these details should be treated as unverified until the release notes appear.
What Website Owners Should Do Before the Patch
Site owners have a few things to do before the patch ships. GoDaddy, which stressed that the issue is industry-wide and not specific to its platform, advises first listing every site and server that runs PHP along with its version. It also suggests considering session.upload_progress.enabled = 0, set in php.ini, a .user.ini file or the hosting control panel. This may stop uploading progress bars from working, and it is neither an official fix nor a complete one. Other researchers warn that it closes only one path, so it can reduce exposure but cannot replace the update. Owners should also take a backup or snapshot, turn on automatic updates where available, and be ready to move quickly, since Sansec has warned that attacks could begin within minutes of the patch going public.
Sources
- https://www.aikido.dev/blog/critical-vulnerabilities-in-php-php2shell
- https://tech.yahoo.com/cybersecurity/articles/know-critical-php-vulnerability-threatening-052457041.html
- https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/
- https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html
