Overview
- PHP announced an out‑of‑cycle security release scheduled for Wednesday, October 21 at 14:00 UTC to publish fixes and full technical details for two critical vulnerabilities rated 9.2 on CVSS v4.0.
- Public reporting linked the flaws to CVE‑2026‑109618 and CVE‑2026‑109619 and circulated an exploit video and tool called “PHP2Shell,” but PHP has not confirmed those identifiers or the leaked technical details.
- Researchers say the bugs are remote code execution (RCE) issues that could let an attacker run commands on a vulnerable server, yet as of the latest reports no confirmed active exploitation has been observed.
- PHP will only issue official fixes for supported branches (8.2–8.5), leaving end‑of‑life installs without vendor patches and increasing the need for upgrades, isolation, or temporary removal from the internet for legacy systems.
- CERTs and vendors urge immediate action: inventory all PHP instances including containers and bundled appliances, prioritize internet‑facing hosts for patching at the release time, deploy WAFs and monitoring for suspicious php processes, and preserve logs if compromise is suspected.