PHP warns of two critical security patches landing imminently
PHP maintainers say two severe vulnerabilities could receive emergency fixes, urging administrators to prepare for rapid updates.
PHP maintainers have warned developers to prepare for two emergency security patches expected on 21 October, with both vulnerabilities reportedly carrying a severity rating of 9.2 out of 10. The maintainers said users should be ready to upgrade as soon as the releases become available, while reserving the right to publish the fixes earlier if further details emerge or active exploitation begins. 12
The warning follows the circulation of purported details about an exploit tool called PHP2Shell. The leaked material has not been independently confirmed in full, but it reportedly showed code execution on web servers running popular software stacks including WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Drupal and WHMCS. PHP maintainers’ advisory is the primary source for the planned patches; Ars Technica reported that security firm watchTowr considers the vulnerabilities real. 12
What PHP users should do
The immediate action is preparation rather than panic. Website operators should identify which PHP versions their systems use, confirm how quickly they can apply security updates and ensure that backups and rollback procedures are available. The advisory says the vulnerabilities may affect every PHP version from PHP 5 onwards, according to the leaked report cited by Ars Technica, but that scope remains part of the unconfirmed material rather than a complete public technical analysis. 12
The reported flaws are tracked as CVE-2026-109618 and CVE-2026-109619. Ars Technica said watchTowr had confirmed the vulnerabilities were real, while details of the exploitation method were still developing. That distinction matters: a high-severity warning is a reason to prepare for rapid patching, not proof that every installation is currently compromised. 2
PHP powers a large share of the web, so the eventual patches could affect hosting providers, content-management systems and self-managed servers well beyond developers who work directly with the language. Administrators should monitor the official PHP release channels and apply the relevant update once the maintainers publish it. Until then, avoid treating reposted exploit demonstrations as a substitute for the official advisory. 1
Our opinion
The unusual part of this warning is the combination of very high claimed severity and incomplete public detail. That makes preparation sensible, but it also makes precise claims dangerous. PHP users should have their update path ready and wait for the maintainers’ package details rather than relying on social-media summaries of PHP2Shell. The next useful milestone is the official patch release, which should clarify affected branches, mitigation and the technical conditions required for exploitation.