Overview
- PHP announced it will publish emergency security updates Wednesday at 14:00 UTC to address two critical remote‑code‑execution vulnerabilities and advised administrators to prepare to upgrade as soon as patches are available.
- Security researchers linked the issues to CVE-2026-109618 and CVE-2026-109619 and said one of the flaws was partially reproduced, while PHP has not yet published technical details or confirmed which versions are affected.
- Reports of a pre‑disclosure leak and an unverified exploit demonstration called “PHP2Shell” circulated before the official release, but the exploit materials and claims of mass testing remain unconfirmed by PHP.
- Administrators are urged to inventory every PHP installation, prioritize internet-facing and unsupported branches for remediation planning, and coordinate with hosting providers to apply the official updates immediately.
- Because PHP powers large parts of the web and many content management systems, a widely exploitable RCE could enable rapid server compromise and site‑wide attacks if fixes are delayed or proof‑of‑concept code appears publicly.