PHP maintainers have issued an urgent advisory warning website administrators to prepare for the imminent release of emergency security patches. The announcement comes less than 12 hours before the fixes are scheduled to drop, following the leak of unconfirmed details regarding two severe vulnerabilities.
The advisory explicitly states that all PHP users should prepare to upgrade as soon as the release is available. Maintainers reserved the right to release the patches earlier if details of either vulnerability become public or if evidence of active exploitation appears in the wild.
Severity Ratings and Unconfirmed Reports
PHP maintainers assigned a severity rating of 9.2 out of 10 to both vulnerabilities. This high rating indicates the potential for significant impact, but it does not confirm the specific capabilities attributed to the flaws in external reports.
Security concerns escalated after an unconfirmed report surfaced claiming that an exploit tool dubbed PHP2Shell could remotely execute code on PHP sites. A video purportedly showing this tool executing code on various web servers was circulated online. The video allegedly demonstrated the exploit on platforms including WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symphony 8.1.9, Drupal 11.4.10, and WHMCS 9.0.9.
Attempts to locate the original unconfirmed report were unsuccessful. However, security firm watchTowr stated it has confirmed that the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are real. The firm claimed the issues affect every PHP version from PHP 5, released in 2004, onward.
Urgency for Mass Attacks
Multiple security firms have urged administrators to take immediate action. Researchers from Sansec stated they expect mass attacks to start within 15 minutes of the patch release. Webfence and Huntress also issued advisories recommending preparation.
PHP is a foundational scripting language for building dynamic websites and web applications. It powers numerous content management systems and internal tools. One security researcher estimated that approximately 1.3 million Internet-connected hosts are likely affected by these vulnerabilities.
Preparation steps recommended by experts include identifying who manages PHP within an organization and taking an inventory of every application built on the language. Administrators are advised to plan a maintenance window starting at 14:00 UTC, with contingency plans for an earlier release. Making a backup of site and database files is also critical.
Some experts suggest unplugging non-essential systems until they are patched. Administrators should monitor the PHP.net homepage for any late-breaking announcements, including potential changes to the release time. Vulnerabilities with the severity described in the advisories have the potential to inflict major damage across the Internet.
Source: Ars Technica
