PHP maintainers issued an advisory announcing plans to release emergency patches for two critical vulnerabilities affecting the programming language. Both vulnerabilities received severity ratings of 9.2 out of a possible 10, prompting urgent action from the development team.
The advisory came following the leak of unconfirmed exploit details, including a video demonstration of a tool called PHP2Shell that reportedly executes code remotely on affected webservers. Security firm watchTowr confirmed that the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are authentic and potentially affect every PHP version from PHP 5 onward, covering nearly all installations currently in operation.
Multiple cybersecurity firms have weighed in on the threat. Sansec researchers predicted mass attacks could begin within 15 minutes of patch release, while Webfence, Huntress, and other security organizations issued advisories urging immediate preparation. Estimates suggest approximately 1.3 million Internet-connected hosts face potential exposure from these vulnerabilities.
PHP developers recommended that administrators take several precautionary measures immediately, including identifying personnel responsible for PHP management, cataloging all applications dependent on the language, scheduling maintenance windows beginning at 14:00 UTC with flexibility for earlier deployment, creating backups of site and database files, and monitoring PHP.net for any announcement of accelerated release timelines. Some security experts suggested disconnecting nonessential systems until patches are applied.
An update indicated that source file fixes were added to the php-src Github repository, with official advisories and package distributions becoming available. PHP powers an estimated 1.3 million Internet-connected systems and serves as a foundational technology for countless websites, content management systems, and web applications globally.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI