# PHP emergency patches coming for critical flaws

> Two severe vulnerabilities in PHP are being patched within hours, affecting millions of websites worldwide.
- Title: PHP emergency patches coming for critical flaws · Ars Technica
- Summary: Two severe vulnerabilities in PHP are being patched within hours, affecting millions of websites worldwide. PHP maintainers are releasing emergency patches…
- Keywords: php, security vulnerabilities, emergency patches, web development, cve-2026-109618, cve-2026-109619, technology, science, emergency, patches, coming, critical
- Source: Ars Technica — https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches
- Published: 2026-10-21T02:12:18+00:00
- Read time: 1 min
- Topics: php, security vulnerabilities, emergency patches, web development, cve-2026-109618, cve-2026-109619, technology, science
## Two critical PHP flaws incoming
PHP maintainers announced Monday they will release patches for two vulnerabilities rated nine point two out of ten severity within twelve hours.

> All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available.
## Exploit tool already circulating
A video showed an exploit tool called PHP2Shell executing code on servers running WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symphony, Drupal and WHMCS.
## Vulnerabilities affect all PHP versions
Security firm watchTowr confirmed the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, affect every PHP version from PHP five released in two thousand four onward.
## Mass attacks expected immediately
Researchers from Sansec said they expect mass attacks to start within fifteen minutes of the release. An estimated one point three million Internet-connected hosts are likely affected.

> expect mass attacks to start within 15 minutes of the release.
## Patches released, update immediately
Source file fixes were added to the php-src Github repository at thirteen thirty-four UTC. Packages and Docker images have begun filtering out as maintainers get their hands on the new sources.
## Key takeaway

PHP maintainers are releasing emergency patches for two vulnerabilities rated nine point two out of ten severity, with fixes expected within twelve hours.