Website administrators, get ready. Patches for what are believed to be unusually severe vulnerabilities are expected to be deployed in just over 12 hours for PHP, a programming language that powers websites and web applications around the world.
PHP officials announced Monday that they plan to release patches for two vulnerabilities, both with a severity rating of 9.2 out of a possible 10.
Waiting for PHP2Shell
“All PHP users are encouraged to prepare now so that you can upgrade as soon as the version is available,” the advisory said. “We reserve the right to publish sooner if details of either vulnerability become public or if evidence of active exploitation appears in the wild.”
Officials issued the notice following the leak of purported details, which have not yet been confirmed. The report showed video of an exploitation tool called PHP2Shell running code on web servers running WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symphony 8.1.9, Drupal. 11.4.10 and WHMCS 9.0.9, all of which use PHP. A video demonstrating the tool has been republished here.
Attempts to locate the unconfirmed report were unsuccessful, but security firm watchTowr said it claims to affect all versions of PHP starting with PHP 5, released in 2004. The security firm went on to claim it has confirmed that the vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, are real.
Gn tech
