DETAILS of two critical PHP vulnerabilities, dubbed PHP2Shell, have leaked online before the planned coordinated disclosure and release of fixes. Tracked as CVE-2026-109618 and CVE-2026-109619, both have a CVSS score of 9.2 and could allow remote code execution. CERT-EU says the score indicates they may be exploitable without authentication. Public reports suggest versions from PHP 5 onwards are affected, but the available information does not identify the root cause, affected component or attack path. One report describes CVE-2026-109618 as a possible use-after-free flaw; this has not been confirmed by PHP.
PHP said on Tuesday that patches were planned for Wednesday, 21 October 2026, at 14:00 UTC, and urged users to prepare to upgrade as soon as they became available. It warned that fixes could be released earlier if technical details emerged or exploitation was detected. WatchTowr said it had reproduced CVE-2026-109618, but withheld technical details until patches were released. WatchTowr and Huntress reported no evidence of either flaw being exploited in the wild.
Sansec nevertheless warned that mass exploitation could begin within 15 minutes of the patch release. In light of the planned fixes and uncertain scope, PHP’s immediate practical advice is to be ready to apply the updates promptly.