PHP project maintainers announced plans to release patches for two high-severity vulnerabilities impacting the programming language used across millions of websites and web applications. The vulnerabilities received severity ratings of 9.2 out of a possible 10, prompting an urgent call for website administrators to prepare for immediate updates upon release.
The advisory was released following reports of purported exploit details, though the specifics remained unconfirmed at the time of initial publication. An unverified video showed a tool called PHP2Shell executing code on web servers running various configurations. Security firm watchTowr confirmed that the identified vulnerabilities, designated as CVE-2026-109618 and CVE-2026-109619, impact all PHP versions dating back to PHP 5 released in 2004. Multiple security research organizations, including Sansec, Webfence, and Huntress, issued their own advisories urging rapid action.
Security researchers warned that attacks could begin immediately following the patch release. Sansec indicated mass exploitation could commence within 15 minutes of patches becoming available. Preparation recommendations included identifying organizational PHP administrators, cataloging all applications built on the language, scheduling maintenance windows with potential for earlier activation, backing up site and database files, and monitoring official PHP channels for announcements regarding accelerated release timelines.
PHP serves as a foundational technology for much of the modern web, powering numerous content management systems and internal business tools. One researcher estimated approximately 1.3 million internet-connected hosts face potential exposure. The vulnerabilities carry the potential for widespread internet-wide damage. Administrators were advised to remain alert for patch availability and to prioritize updates immediately upon release, with some experts recommending offline status for non-critical systems until patching was complete.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI