PHP has announced plans to ship an out-of-cycle security release to address a pair of critical vulnerabilities that have sent ripples through the cybersecurity community. The PHP security team has rated both flaws at 9.2 on the Common Vulnerability Scoring System (CVSS) v4.0 scale, though official descriptions and full technical details have been kept under wraps ahead of the scheduled patch deployment.
Security researchers tracking the development, notably at watchTowr, have stated that the two vulnerabilities enable remote code execution, posing a significant risk to affected web applications and server environments. However, the upcoming fixes will exclusively target the four currently supported PHP branches, spanning versions 8.2 through 8.5. As of the latest updates, no active exploitation of these specific vulnerabilities has been reported in the wild.
The rush to publish an advance notice was triggered by an unexpected information leak. On October 20, a post surfaced on Hacker News claiming that two high-severity PHP remote code execution flaws affecting versions dating all the way back to PHP 5 would be formally disclosed. The anonymous poster assigned a maximum CVSS rating of 10.0 to the vulnerabilities and stated that a public reveal was planned for Thursday, October 22, though they admitted they had no supporting evidence beyond asking readers to trust the source.
Shortly after the discussion gained traction, security firm watchTowr posted a confirmation on the social media platform X, verifying that the leaked information was authentic. According to watchTowr, the two flaws were actively under a coordinated disclosure embargo and the broader research community had been expected to maintain silence until the scheduled Thursday date. Because the details were already circulating prematurely, watchTowr indicated it could not share further specifics at that juncture.
Responding to the premature disclosure, the PHP team published an advance security notice at 19:33 UTC on the evening of October 20. The schedule was accelerated to deploy fixes on Wednesday, a day earlier than the date mentioned in the initial leak. In its advisory, PHP noted that it reserves the right to release patches earlier than planned should details of either vulnerability become public or if concrete evidence of active exploitation appears in the wild.
The initial leak primarily revealed the existence of the flaws, an associated timeline, CVE identifiers, and severity metrics, stopping short of publishing technical exploit mechanics or proof-of-concept code. While the leaked post cited a CVSS score of 10.0, the official PHP rating for the vulnerabilities stands at 9.2 using version 4.0 of the scoring framework.
The identifiers being utilized by researchers to track the issues are CVE-2026-109618 and CVE-2026-109619, both of which appeared in the leaked forum post. Notably, the official PHP advance notice did not explicitly name these identifiers. Furthermore, claims that every PHP version released since version 5 is vulnerable remain unconfirmed by official channels. A dedicated frequently asked questions page published by watchTowr regarding CVE-2026-109618 acknowledged that the expansive scope of affected versions has not been verified by an official vendor advisory, and no specific configuration settings or feature requirements have been detailed yet.
PHP has emphasized that full technical details, a precise list of affected versions, and the corresponding fixed versions will be published alongside the official software release. In the absence of official vendor nomenclature, researchers have begun referring to the vulnerability pair as "php2shell," a moniker coined by the security community rather than the PHP development team.
Regardless of how wide the affected version range ultimately proves to be, PHP maintains a strict policy of issuing security patches exclusively for its currently supported branches, documenting all changes within its official changelogs. Under this policy, versions 8.2 and 8.3 receive strictly security-related maintenance, while versions 8.4 and 8.5 benefit from active support.
For installations running older, legacy iterations—including PHP 8.1, 8.0, the entire 7.x series, and long-abandoned 5.x versions—no vendor patches will be forthcoming, as these branches have reached their end-of-life status. If testing reveals that these older environments are susceptible to the flaws, administrators running unmaintained software will find themselves without an official vendor-supplied upgrade path.
Data compiled by the security company Mallory sheds light on the scale of potential exposure. According to scans of internet-facing hosts conducted via the Shodan search engine, approximately 884,000 servers reported running a PHP version of 8.1 or older in their HTTP banners, accounting for roughly 59 percent of the 1.5 million hosts that returned any PHP version string. A further 740,000 hosts reported running PHP without exposing a specific version number in their banners, highlighting the massive footprint of potentially legacy installations across the public web.
At the time of the advance notice, PHP had not released any official workarounds to mitigate the risks before patching. Security organizations, including Huntress and CERT-EU, have provided rapid-response advisory steps to help administrators prepare their infrastructures while awaiting the software updates.
Independent threat intelligence monitors have corroborated that malicious exploitation has not yet been observed in partner environments. Huntress confirmed that it had not built or reproduced a proof-of-concept exploit, nor was it aware of any public exploit code circulating as of October 20. Similarly, watchTowr’s tracking indicated zero reported exploitation instances, and the flaws do not currently appear in the Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog.
This measured beginning contrasts sharply with past PHP security incidents. When CVE-2024-4577—a critical vulnerability affecting PHP running in CGI mode on Windows systems—was publicly disclosed in June 2024, threat actors rapidly weaponized the flaw, with honeypot servers registering active exploit attempts within 24 hours of public release.
The impending software release is expected to resolve lingering uncertainties by clarifying the exact scope of vulnerability, identifying which internal components of PHP are involved, and determining whether successful exploitation depends on specific execution modes, server configurations, or user authentication. Until the patches become publicly available, system administrators worldwide remain on high alert, preparing their environments to apply the necessary updates as soon as the official binaries and advisories land.
