TWO critical PHP remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, were disclosed ahead of the security patches scheduled for 21 October 2026. Together dubbed “PHP2Shell”, the vulnerabilities were due to be announced at 2pm GMT alongside fixes. A Hacker News forum post published on 20 October revealed the CVE identifiers and claimed the flaws affected PHP versions dating back to PHP 5, with the potential for remote code execution and server takeover. The post has since been deleted.
WatchTowr confirmed that disclosure had been scheduled, but the article reports no evidence that the vulnerabilities were being exploited.
The PHP security team confirmed it was preparing patches and assigned the flaws a critical CVSS score of 9.2, rather than the 10.0 claimed in the leaked post. It said it could release fixes earlier if details became public or active exploitation was detected. The vulnerabilities could affect servers running PHP, which W3Techs data cited by the article says is used by about 69.7% of websites with a known server-side programming language, including sites using WordPress, Drupal, Joomla and Magento.
CERT-EU and the UK’s National Cyber Security Centre issued emergency advisories urging organisations to prepare to patch affected systems promptly. CERT-EU said organisations unable to patch immediately should consider isolating internet-facing applications from public networks until a fix is available. Based on PHP pre-release builds, researcher Kevin Beaumont suggested the fixed versions would likely be 8.5.12, 8.4.27, 8.3.36 and 8.2.35; these were projections, not confirmed release versions in the article.