PHP security team rushes patches after early leak of critical vulnerabilities
Two high-severity PHP flaws were disclosed a day before the planned release, prompting the PHP project and European cyber authorities to urge immediate remediation.
Two remote-code-execution vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619 and collectively dubbed “PHP2Shell,” were made public on October 20, a day before the scheduled disclosure and patch rollout. The leak originated from a post on the Hacker News forum by a user named “petecooper,” who revealed the CVE numbers and claimed the flaws affected PHP versions dating back to PHP 5.
The PHP security team confirmed that patches were slated for release at 14:00 GMT on October 21, and said it could accelerate the rollout if details became public or active exploitation was observed. > “We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.”
CERT-EU and the UK’s National Cyber Security Centre issued emergency advisories urging organizations to prepare for immediate patching. CERT-EU recommended isolating internet-facing applications when patching cannot be performed promptly. > “Where immediate patching is not feasible, organizations should consider isolating internet-facing applications from public networks until a fix is available,”
PHP powers roughly 70 % of websites with known server-side languages, including major content-management systems such as WordPress, Drupal, Joomla and Magento. Independent researcher Kevin Beaumont indicated that the forthcoming fixed versions are likely to follow the pre-release builds currently available.