PHP to Release Two Critical Security Patches Following Exploit Reports

21 October 2026 2 min read هدهد تك | Hudhud Tech

PHP maintainers have announced plans to release two emergency patches within the next 12 hours to address severe vulnerabilities rated 9.2 out of 10 in severity.

The advisory encourages all PHP users to prepare for the upgrades as soon as they become available. The maintainers indicated that they might release the patches earlier if details of the vulnerabilities become public or if evidence of active exploitation emerges.

This announcement follows the leak of information regarding an exploit tool named PHP2Shell, which reportedly executes code on various web servers running popular applications such as WordPress, MediaWiki, and Joomla. The tool’s capabilities were demonstrated in a video that has circulated online.

Security firm watchTowr claims that the vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, affect all PHP versions from PHP 5 onward. They confirmed the existence of these vulnerabilities, which could lead to widespread exploitation.

Researchers from Sansec have warned that mass attacks could begin shortly after the patches are released. Other security firms, including Webfence and Huntress, have also advised website administrators to take immediate action to safeguard their systems.

Preparation steps recommended include identifying personnel responsible for PHP management, inventorying applications built on PHP, scheduling maintenance windows, backing up site and database files, and monitoring PHP.net for updates.

As an open-source scripting language, PHP is widely used for building dynamic websites and applications, making it a critical component of the web infrastructure. An estimated 1.3 million internet-connected hosts could be affected by these vulnerabilities, underscoring the urgency for administrators to remain vigilant until the patches are released.