Key points
- Two critical vulnerabilities rated 9.2 on CVSS v4.0 allow remote code execution.
- Patches are scheduled for release on Wednesday at 10 a.m. EDT.
- Early attacks are already emerging, with Cloudflare deploying temporary firewall rules.
The PHP project is releasing an unscheduled security update on Wednesday at 10 a.m. EDT to address two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. These flaws, rated 9.2 on the CVSS v4.0 scale, enable remote code execution that could allow attackers to take control of servers.
Researchers have dubbed the vulnerabilities “php2shell.” Details leaked online before the planned release, prompting the team to move the patch date forward. A major internet infrastructure company reported early attacks, leading the PHP team to accelerate the fix availability to mitigate immediate risk to global web services.
View the original post on X
View the original post on X
Scope and Exposure
The potential impact is widespread because PHP powers between 70% and 80% of websites with a known server-side language. Platforms including WordPress, Drupal, Joomla, and Laravel rely on this technology. CERT-EU states the flaws could affect every PHP version from 5 onward, though the PHP team has not officially confirmed the complete list of affected versions yet.
Security firms estimate more than 1.3 million internet-exposed hosts are vulnerable. A Shodan search identified approximately 1.9 million potentially affected servers. VirusTotal data indicates that about 758,000 of these servers run unsupported versions from 5.4 through 8.1, while only 272,000 run currently supported branches.
Next steps
The PHP team plans to publish full technical details alongside the Wednesday release. Until then, unverified exploit code is circulating online, which security firms warn may be laced with malware. Cloudflare has deployed firewall rules covering known exploit vectors to all customers, including free accounts, calling this protection a temporary stopgap while permanent patches are distributed.
Signals worth monitoring
Security teams should review web server access logs for unusual POST requests or unexpected command execution patterns. Look for spikes in traffic from unknown sources targeting PHP endpoints. Check for new processes spawned by the web server user or outbound connections to unfamiliar IP addresses. Verify file integrity on critical directories to detect unauthorized script modifications. Isolate compromised hosts immediately to prevent lateral movement across the network.
What to do and how to stay safe: PHP
- Apply the Wednesday PHP update as soon as it becomes available to patch the critical flaws.
- Implement temporary firewall rules to block known exploit vectors if immediate patching is not possible.
- Monitor server logs for signs of unauthorized access or unusual command execution.
- Verify the integrity of web server files to detect any malicious scripts added by attackers.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
When will the patches for the critical PHP vulnerabilities be released?
The patches are scheduled for release on Wednesday at 10 a.m. EDT.
What are the CVE IDs for these vulnerabilities?
The vulnerabilities are catalogued as CVE-2026-109618 and CVE-2026-109619.
Which PHP versions are affected by these flaws?
CERT-EU states the flaws could affect every version of PHP from 5 onward.
