Two critical remote code execution vulnerabilities carrying a severity score of 9.2 out of 10 on the CVSS v4.0 scale (an international standard used to measure the severity of software security flaws) have forced the PHP security team to schedule an emergency patch release for 14:00 UTC on Wednesday (21). Language maintainers accelerated the deployment schedule after confidential details regarding the flaws leaked online ahead of the official disclosure embargo.

System administrators received an urgent warning on Tuesday, October 20, 2026, at 19:33 UTC via the project’s official ANNOUNCE mailing list, instructing teams to prepare server environments for immediate package installation. “We reserve the right to release earlier if details of either vulnerability become public, or if evidence of active exploitation emerges,” the PHP security team stated in the notice.

Embargo breach exposes CVE-2026-109618 and CVE-2026-109619

Although the advance warning from the project maintainers omitted specific tracking numbers and technical specifications, analysts at the cybersecurity firm watchTowr and the Computer Emergency Response Team for the European Union (CERT-EU) identified the flaws as CVE-2026-109618 and CVE-2026-109619. Security specialists dubbed the pair of vulnerabilities php2shell, classifying both as remote code execution (RCE) bugs that allow unauthenticated attackers to run arbitrary commands on a target server. Analysts at watchTowr stated they believe their team internally reproduced CVE-2026-109618, adding that the firm will withhold technical mechanics until the official patches are available.

Public exposure of the confidential flaws began on Tuesday (20) when a user operating under the handle petecooper posted a message—which was later deleted—on the Hacker News forum, sparking rapid circulation across social media platforms. Shortly afterward, security researcher Kirill Firsov shared a video online demonstrating the php2shell exploit chain, attributing the discovery and footage to researcher LCFR and the firm Calif.io. Both the initial forum leak and watchTowr originally assigned the bugs a maximum CVSS score of 10.0, a figure that differed from the official 9.2 rating published hours later by PHP maintainers.

Benjamin Harris, chief executive officer (CEO) of watchTowr, confirmed the breach of the disclosure schedule in a public statement. “In the last hour, two remote code execution vulnerabilities in PHP leaked. These vulnerabilities were previously under embargo and scheduled for disclosure on Thursday at 11:00 AM ET,” Harris stated. The executive also verified the legitimacy of the threat: “While we cannot share technical information at this time for obvious reasons given the sensitivity, we can confirm that these vulnerabilities are indeed real. Both have a CVSS score of 10 and are understood to affect PHP versions 5, 6, 7, and 8.”

Read also: FC Cincinnati vs D.C. United: where to watch live, kick-off time and lineups (MLS, Oct 21)

Early exploitation attempts and global web exposure

While no active intrusions were recorded on the day of the leak, threat activity shifted on the morning of Wednesday (21). At 07:43 UTC, Cloudflare chief technology officer (CTO) Dane Knecht reported that the network infrastructure company had begun detecting early attack attempts targeting PHP-based websites using the vulnerabilities. Meanwhile, security firm Sansec estimated that widespread automated exploitation across the internet would commence within 15 minutes of the official patch release.

Powering roughly 69.7% of all websites whose server-side programming language is known, according to data from W3Techs, PHP serves as the foundational script for major content management systems like WordPress, Drupal, and Joomla, alongside e-commerce platforms such as Magento, Shopware, and WooCommerce. The moniker php2shell references historic high-impact vulnerabilities and highlights the potential for attackers to obtain a remote command terminal (shell) on unpatched servers. Official confirmation from the development team regarding the exact list of affected releases remains pending: whereas the Hacker News leak and watchTowr indicated exposure across generations 5, 6, 7, and 8, a screenshot of the exploit tool and analysis from Sansec suggest the flaw affects systems starting from PHP 5.4.0.

Technical specifications and release schedule for the patches

Confirmed parameters surrounding the emergency remediation packages, tracking identifiers, and release timelines include the following operational details:

• Vulnerability identifiers: CVE-2026-109618 and CVE-2026-109619 (collectively referred to as php2shell).
• Official severity rating: 9.2 out of 10 on the CVSS v4.0 scale for each of the two vulnerabilities.
• Scheduled patch deployment: Wednesday (21) at 14:00 UTC (10:00 AM EDT / 11:00 AM BRT).
• Original embargo target prior to the leak: Thursday (22) at 11:00 AM ET.
• Expected patched versions (tracked by Tenable, Alpine Linux, and independent researcher Kevin Beaumont): PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, stepping up from the September 24, 2026 builds (8.5.11, 8.4.26, 8.3.35, and 8.2.34).

Unsupported branches and server mitigation guidelines

Only actively supported branches of the programming language—specifically PHP 8.2, 8.3, 8.4, and 8.5—are scheduled to receive official upstream security packages on Wednesday (21), with security support for the 8.2 branch slated to conclude on December 31, 2026. System administrators operating end-of-life releases below version 8.2, encompassing PHP 5, 7, 8.0, and 8.1, will not receive official patches from the project. Internet scanning data collected via Shodan on Tuesday (20) by cybersecurity firm Mallory identified approximately 884,000 internet-facing hosts running PHP 8.1 or older, representing roughly 59% of the 1.5 million servers that publicly disclosed their PHP version.

Keep reading: Los Angeles Clippers vs Sacramento Kings: where to watch live and start time (NBA, Oct 21)

Responding to the risk of immediate server takeover, CERT-EU issued Security Advisory 2026-018 alongside alerts from the UK National Cyber Security Centre (NCSC), urging organizations to apply the updates immediately upon release or isolate internet-facing applications from public networks if rapid patching is unfeasible. As a temporary defensive measure prior to package installation, Sansec recommended blocking multipart/form-data requests directly at the web server level.

Neither the exact technical root cause of the two vulnerabilities nor confirmation of whether default PHP installations are exposed without specific configurations has been publicly disclosed. Security firms also warn that public code repositories claiming to offer proof-of-concept (PoC) exploits for php2shell have begun circulating online, noting that these files remain unverified and may contain malware. PHP developers are scheduled to publish the full technical advisory, the definitive list of vulnerable versions, and the updated installation files at 14:00 UTC on Wednesday (21).