PHP developers announced plans to release patches addressing two high-severity vulnerabilities in the widely-used programming language. Both issues received severity ratings of 9.2 out of a possible 10, prompting urgent guidance for website administrators and developers to prepare for immediate updates.
The announcement followed the circulation of unconfirmed reports detailing a purported exploit tool called PHP2Shell, which allegedly demonstrates remote code execution capabilities on affected systems. While initial reports remain unverified, security researchers at watchTowr confirmed the vulnerabilities are genuine and assigned them tracking identifiers CVE-2026-109618 and CVE-2026-109619. According to available information, the issues potentially affect every PHP version released since 2004.
Multiple security firms warned of imminent risks following the disclosure. Analysts predicted widespread exploitation attempts could begin immediately after patches become available to the public. Given PHP’s ubiquity across web infrastructure—powering content management systems, WordPress installations, and numerous internal applications—the potential impact extends across millions of internet-connected systems globally.
PHP maintainers advised all users to prepare for rapid deployment of fixes, including identifying responsible personnel, cataloging affected applications, scheduling maintenance windows, and backing up critical data. Officials stated they reserved the right to accelerate the release timeline if vulnerability details became public or evidence of active attacks emerged. According to updates provided later, source code fixes were committed to the official repository, with packages and container images becoming available as maintainers processed the new sources.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI