From Ars Technica · · 1m 10s
PHP emergency patches coming for critical flaws
Two severe vulnerabilities in PHP are being patched within hours, affecting millions of websites worldwide.
In brief
Two severe vulnerabilities in PHP are being patched within hours, affecting millions of websites worldwide. PHP maintainers are releasing emergency patches for two vulnerabilities rated nine point two out of ten severity, with fixes expected within twelve hours. Originally reported by Ars Technica.
Two critical PHP flaws incoming
PHP maintainers announced Monday they will release patches for two vulnerabilities rated nine point two out of ten severity within twelve hours.
“All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available.”
Exploit tool already circulating
A video showed an exploit tool called PHP2Shell executing code on servers running WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symphony, Drupal and WHMCS.
Vulnerabilities affect all PHP versions
Security firm watchTowr confirmed the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, affect every PHP version from PHP five released in two thousand four onward.
Mass attacks expected immediately
Researchers from Sansec said they expect mass attacks to start within fifteen minutes of the release. An estimated one point three million Internet-connected hosts are likely affected.
“expect mass attacks to start within 15 minutes of the release.”
Patches released, update immediately
Source file fixes were added to the php-src Github repository at thirteen thirty-four UTC. Packages and Docker images have begun filtering out as maintainers get their hands on the new sources.
The takeaway
PHP maintainers are releasing emergency patches for two vulnerabilities rated nine point two out of ten severity, with fixes expected within twelve hours.
