The PHP development team has announced plans to ship an out-of-cycle emergency security release to address two critical vulnerabilities impacting the widely used programming language. The security team has assigned a severity rating of 9.2 out of 10.0 on the CVSS v4.0 scale to the flaws, though full technical descriptions and vulnerability details have been withheld pending the official patch deployment.
According to cybersecurity researchers at watchTowr, the two newly discovered security issues enable remote code execution (RCE) on vulnerable servers. However, because PHP has yet to release the official patch or complete technical advisories, the exact mechanism of the vulnerabilities remains restricted. Only the four currently supported PHP branches—ranging from version 8.2 up to 8.5—are scheduled to receive official vendor fixes for these flaws. At the time of the announcement, no active exploitation of the vulnerabilities had been reported in the wild.
The decision by the PHP security team to issue an accelerated out-of-cycle update followed an unexpected leak that surfaced online. On October 20, a discussion post on Hacker News claimed that two severe PHP remote code execution flaws, carrying a maximum CVSS rating of 10.0 and supposedly affecting all PHP versions dating back to PHP 5, were slated for public disclosure on Thursday, October 22. The anonymous poster acknowledged that they possessed no hard evidence to back up their claims beyond asking readers to trust the source.
Shortly after the discussion gained traction, security intelligence firm watchTowr confirmed via social media that the leaked information was authentic. The firm noted that the vulnerabilities were currently under a strict embargo and that researchers and observers were originally expected to maintain silence until the scheduled Thursday disclosure window. Following the leak and subsequent confirmation from security researchers, the PHP project published an advance notice late in the evening on October 20, pushing the anticipated release date up to Wednesday, a full day ahead of the timeline leaked on Hacker News.
In its official notice, the PHP project stated that updates could be deployed earlier than initially planned if details regarding either vulnerability became public prematurely or if concrete evidence of active exploitation began to appear in real-world environments.
The initial leak primarily revealed the existence of the flaws, assigned CVE identifiers, a general date, and a severity score, while omitting any operational details on how the vulnerabilities could be weaponized. The CVSS 10.0 rating cited in the leak originated from the anonymous post itself, whereas the official PHP security assessment evaluates the vulnerabilities at 9.2 under version 4.0 of the Common Vulnerability Scoring System.
The specific identifiers being tracked by researchers are CVE-2026-109618 and CVE-2026-109619, both of which appeared in the leaked forum post. Notably, the official advance notice published by PHP does not explicitly list these identifiers. Furthermore, claims that every PHP version released since version 5 is vulnerable remain entirely unconfirmed. In an independent frequently asked questions document published regarding CVE-2026-109618, watchTowr emphasized that the broader scope of affected software has not been validated by an official vendor advisory, nor have any specific configuration requirements or necessary feature sets been detailed by the maintainers.
PHP maintainers have maintained that full technical details, precise lists of affected versions, and updated secure packages will be published concurrently with the software release. In the cybersecurity community, researchers have begun referring to the pair of vulnerabilities under the collective moniker "php2shell," though this name was coined by the research community rather than the official PHP organization.
Regardless of how broad the final scope of affected versions turns out to be, PHP’s standard support policy dictates that patches are developed and released exclusively for its four currently maintained branches. Changes and security updates for each active branch are documented directly in the official PHP changelogs. Under the current lifecycle policy, versions 8.2 and 8.3 receive strictly security-related updates, while versions 8.4 and 8.5 remain in active, full-support development phases.
Any legacy installations running older, unsupported iterations—including versions 8.1, 8.0, 7.x, and 5.x—have reached their official end-of-life status and will not receive backported vendor patches from the PHP project. If these newly discovered vulnerabilities ultimately impact those older, legacy branches, systems running them will be left without an official vendor-supplied patch, forcing administrators to rely entirely on internal mitigations, network segmentation, or upgrading their underlying application environments.
To provide perspective on the potential attack surface, security analytics firm Mallory analyzed data from the Shodan search engine and reported that approximately 884,000 internet-facing hosts broadcasted an HTTP server banner indicating a PHP version of 8.1 or older. This figure represented roughly 59 percent of the roughly 1.5 million total hosts that reported any specific PHP version in their banners on October 20. Analysts note that these numbers reflect public-facing server banners rather than confirmed vulnerable systems, and an additional 740,000 hosts exposed PHP details without revealing a specific version number.
As of the latest updates from security firms such as Huntress and watchTowr, no active exploitation of CVE-2026-109618 or CVE-2026-109619 has been observed across partner environments, nor have public exploit proofs of concept been released. Additionally, the vulnerabilities do not currently appear on the Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog. This contrasts sharply with previous high-profile incidents, such as CVE-2024-4577—a critical PHP CGI-mode vulnerability affecting Windows systems discovered in June 2024—which attracted automated scanning and active exploit attempts against honeypot infrastructure within 24 hours of public disclosure.
The forthcoming security release is expected to provide critical clarity regarding the exact software versions affected, the internal components involved, whether successful exploitation depends on specific runtime configurations or user authentication levels, and how the core development team formally characterizes the flaws. Until the patches are deployed and reviewed by system administrators globally, web infrastructure teams continue to monitor advisories closely for further guidance from PHP maintainers.
