PHP maintainers said on Monday, 19 October, that patches for two vulnerabilities were due to be released within a little over 12 hours. Both were rated 9.2 out of 10 for severity. The maintainers urged users to prepare to update as soon as fixes became available, and said they might release them sooner if details became public or there was evidence of exploitation in the wild.
The warning followed a leak of purported vulnerability details that had not been confirmed. A video reportedly showed an exploit tool called PHP2Shell executing code on servers running several PHP-based products, including WordPress 7.1.3, MediaWiki 1.46.2, Magento 2.4.9 and Drupal 11.4.10. Security firm watchTowr said the flaws, identified as CVE-2026-109618 and CVE-2026-109619, were real and claimed they affected every PHP version from PHP 5 onwards. The article does not report confirmed attacks in the wild.
A researcher estimated that 1.3 million internet-connected hosts might be affected, while Sansec predicted mass attacks could begin within 15 minutes of the patches’ release.
Recommended preparation included identifying who manages PHP, listing the organisation’s PHP-based applications, scheduling a maintenance window for 14:00 UTC with plans for an earlier release, backing up websites and databases, and watching PHP.net for announcements. Some experts suggested disconnecting non-essential systems until they were patched.