Description

On October 20, 2026, the PHP security team announced an emergency security update scheduled for October 21, 2026, at 14:00 UTC (21:00 Vietnam time), addressing two critical vulnerabilities rated 9.2 on the CVSS v4.0 scale. The announcement came after vulnerability details were leaked ahead of the official disclosure date; PHP stated it might release updates earlier if details became public or active exploitation occurred.

These are two remote code execution (RCE) vulnerabilities in the PHP core, tracked under CVE-2026-109618 and CVE-2026-109619, reported to affect PHP branches 5 through 8. According to multiple sources (unconfirmed by PHP), the vulnerabilities were discovered and reported by the Calif research team, and the exploitation chain has been dubbed "php2shell." The CVE IDs were also provided by external sources and were not mentioned in PHP's initial notice. Because the flaw lies within the PHP core itself, any application running on PHP could potentially be affected (WordPress, Drupal, Joomla, Magento, shared hosting, control panels, etc.).

At the time of writing, no active exploits or confirmed public exploit codes have been observed, but automated exploitation tools targeting multiple popular PHP applications (WordPress, Joomla, Laravel, MediaWiki) have already emerged, indicating a high risk of widespread exploitation as soon as details go public (unverified information from official sources). Sansec predicts mass attacks within 15 minutes of the patch release.

Root cause, attack vectors, and exploitation conditions have not yet been disclosed; PHP will publish full details, affected versions, and patched versions alongside the release. This is an early warning and will be updated as official information becomes available.

  • CVSS Score: 9.2 (CVSS v4.0, both vulnerabilities, rated by the PHP security team)

  • Severity: Critical

Scope of Impact

The vulnerabilities reside in the PHP core. The official scope of impact will be announced alongside the release; at the time of writing, gathered information is as follows:

  • Affected versions (unconfirmed): Public reports indicate impact from PHP 5.4.0 and above (according to Sansec) or PHP branches 5 to 8 (according to watchTowr); not yet confirmed by PHP.

  • Supported branches: PHP 8.2 and above, expected to receive patches.

  • End-of-life (EOL) branches: PHP 8.1 and below will not receive official patches (according to Sansec and other sources).

  • Patched versions (expected): 8.5.12, 8.4.27, 8.3.36, and 8.2.35, according to non-PHP sources (Mallory, Phoenix Security).

Impact

Successful exploitation of the vulnerabilities can lead to:

  • Remote code execution (RCE) on servers running PHP; exploitation conditions (whether authentication is required, affected configurations) have not yet been disclosed.

  • Full control over web applications and servers, access to source code, configurations, credentials, and data, web shell installation, and lateral movement to related infrastructure.

  • Widespread impact on systems running on PHP such as Magento, Shopware, and WooCommerce stores (according to Sansec).

Mitigation

  • Immediately inventory servers, containers, and services running PHP (versions, SAPIs like PHP-FPM, mod_php, CLI; internet-facing systems) to prepare for upgrades once the release is published.

  • Upgrade to the corresponding patch for your active PHP branch as soon as PHP releases it (expected 8.5.12, 8.4.27, 8.3.36, or 8.2.35; verify against the official announcement). For systems using OS packages, hosting providers, or containers, monitor and apply updates from the vendor, then rebuild and redeploy images.

  • Systems running PHP 8.1 and below will not receive official patches and must plan to upgrade to a supported branch (8.2 or higher) or apply vendor backported patches (if available). No workarounds have been published at the time of writing.

  • Prioritize internet-facing servers; monitor web server/PHP-FPM logs, anomalous processes (e.g., sh/bash spawned from php-fpm or Apache), and new or modified PHP files within web directories—especially after technical details are published, as Sansec predicts mass exploitation will emerge very rapidly.

References

https://www.php.net/archive/2026.php#2026-10-20-1
https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/

https://watchtowr.com/intelligence/php-cve-2026-109618-faq/

https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities

https://mallory.ai/blog/php-rce-rapid-response

https://sansec.io/research/php2shell

https://www.runzero.com/blog/php/