GoKawiilPHP maintainers plan emergency patches for two 9.2-severity vulnerabilities
PHP maintainers announced Monday that patches for two vulnerabilities, each rated 9.2 out of 10 in severity, would be released within about 12 hours. The advisory followed leaked, unconfirmed details of an exploit tool called PHP2Shell demonstrated against popular PHP-based platforms including WordPress, Magento, Drupal, and Joomla. Security firm watchTowr said the flaws, tracked as CVE-2026-109618 and CVE-2026-109619, appear to affect every PHP version since PHP 5 in 2004 and that it has confirmed they are genuine.
GoKawiil's interpretation of the reporting above, not reported fact.
Given PHP's role underpinning a huge share of the web, flaws of this severity could expose countless sites and applications to remote compromise if exploit details become public before patches are widely applied. The maintainers' warning that they may release early if exploitation is detected suggests concern that attackers could move quickly once the leaked details circulate further. Confirmation from an independent security firm adds credibility to claims that initially emerged through an unverified report.
- PHP maintainers plan to release patches for two vulnerabilities rated 9.2/10 in severity.
- Leaked details reportedly show an exploit tool, PHP2Shell, working against major PHP platforms like WordPress, Drupal, and Magento.
- Security firm watchTowr says the vulnerabilities affect PHP versions dating back to 2004 and has confirmed they are real.
Source: arstechnica.com, 2026-10-21
Published there as: “PHP warns it plans to release 2 emergency patches imminently”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.