PHP has issued an out-of-cycle security release addressing two critical PHP RCE flaws, collectively nicknamed php2shell, with a CVSS v4.0 score of 9.2. The vulnerabilities are identified in the leak as CVE-2026-109618 and CVE-2026-109619. Researchers from watchTowr say the bugs allow remote code execution, but PHP notes that full details, affected versions, and fixed versions will be published with the release.
The advance notice put the fix window at 14:00 UTC on 21 October 2026 and restricted initial confirmation to the four currently supported PHP branches (8.2–8.5). At the time of reporting, exploitation had not yet been observed in the wild.
The article emphasises that the scope and exact conditions of impact were not officially confirmed. PHP’s guidance states only that patches will be available for the four supported branches, with 8.2 and 8.3 receiving only security fixes and 8.4–8.5 in active support; older branches are out of support. Estimates from security researchers suggest a substantial exposure, with hundreds of thousands of publicly visible hosts running older PHP banners, though banner data does not prove vulnerability status.
Practical response steps recommended in related coverage include inventorying all PHP installations (including vendor appliances and control panels), prioritising internet-facing systems for patching, isolating or backporting where patching isn’t immediate, and monitoring for signs of PHP executing shells, interpreters, or download tools. CERT-EU also advises isolating internet-facing applications if fixes cannot be applied promptly.