PHP to Release Emergency Patch for Two Critical RCE Vulnerabilities

PHP is set to release an emergency security update at 14:00 UTC on October 21 to address two critical vulnerabilities rated 9.2 on the CVSS v4.0 scale. The details of these vulnerabilities have not yet been disclosed.

Researchers at watchTowr have indicated that these flaws enable remote code execution. The fix will only be available for the four supported PHP branches, specifically versions 8.2 through 8.5, and there have been no reports of exploitation to date.

The announcement follows a leak that occurred on October 20, where a post on Hacker News claimed that two PHP remote code execution vulnerabilities, rated CVSS 10.0 and affecting versions from PHP 5 onward, would be revealed on October 22. The poster admitted to having no substantial evidence to support this claim.

In response, watchTowr confirmed on X that the leaked information was accurate, stating that the two vulnerabilities were under embargo and that further details could not be shared at that time.

PHP published a notice on the evening of October 20, stating that the release was scheduled for October 21, a day earlier than indicated by watchTowr. The notice also mentioned that PHP might expedite the release if details of either vulnerability became public or if evidence of active exploitation emerged.

The leak included the existence of the vulnerabilities, their severity score, a release date, and two CVE identifiers: CVE-2026-109618 and CVE-2026-109619. However, PHP’s notice did not confirm these identifiers. The claim that all versions since PHP 5 are affected remains unverified, as watchTowr’s FAQ notes that this has not been confirmed by an official vendor advisory.

PHP stated that full details, including affected versions and fixed versions, would be published with the release. Researchers have started referring to the vulnerabilities as php2shell, a name not officially recognized by PHP.

Regardless of the final affected range, PHP only provides fixes for its four supported branches. These branches and their current release statuses are:

• 8.5: 8.5.11, active support until December 31, 2027
• 8.4: 8.4.26, active support until December 31, 2026
• 8.3: 8.3.35, security fixes only until December 31, 2027
• 8.2: 8.2.34, security fixes only until December 31, 2026

Versions older than 8.2, including 8.1, 8.0, 7.x, and 5.x, are no longer supported and will not receive a patch. If the vulnerabilities affect these older branches, installations running them will not have a vendor patch available.

According to security company Mallory, approximately 884,000 internet-facing hosts reported a PHP version of 8.1 or older to the Shodan search engine on October 20, representing 59% of the roughly 1.5 million hosts that reported any version. This count is based on HTTP banners, not confirmed affected systems, and an additional 740,000 hosts reported PHP without a version.

PHP has not provided any workarounds for the vulnerabilities. In the meantime, security experts recommend several preparatory steps, largely based on a rapid-response post from Huntress, along with isolation advice from CERT-EU:

1. Inventory all PHP installations, including those bundled in vendor appliances, Windows software, and control panels like cPanel and Plesk.
2. Be prepared to upgrade at 14:00 UTC, prioritizing internet-facing systems, and check with your Linux distribution and hosting provider for backported packages.
3. If using an end-of-life branch, upgrade, take the system offline, or place it behind a VPN or web application firewall until an upgrade can be performed.
4. If immediate patching is not possible, CERT-EU advises isolating internet-facing applications from public networks until a fix is available.
5. Monitor PHP processes, alerting on php-fpm, php-cgi, httpd, or apache2 launching shells or interpreters. On Linux servers without endpoint detection, consider using Florian Roth’s process-watcher to log every program initiated by a PHP process.
6. If any suspicious activity is detected, isolate the server, preserve web server and PHP logs, and investigate for web shells, new files in the web root, new cron jobs, scheduled tasks, and accounts.

As of October 20, Huntress reported no exploitation of the vulnerabilities in its partner environments and had not created or reproduced a proof of concept. watchTowr’s FAQ also noted that no exploitation had been reported as of October 21, and the vulnerabilities were not listed in CISA’s Known Exploited Vulnerabilities catalog.

The upcoming release is expected to clarify details that have been withheld, including which versions are affected, the specific components of PHP involved, and whether an attack necessitates a particular configuration or login. As of now, PHP has not yet released the fixes.

Source: The Hacker News