GoKawiilPHP maintainers plan emergency patches for two 9.2-severity vulnerabilities
PHP maintainers announced Monday that patches for two vulnerabilities, each rated 9.2 out of 10 in severity, would be released within about 12 hours. The advisory followed leaked, unconfirmed details of an exploit tool called PHP2Shell demonstrated against popular PHP-based platforms including WordPress, Magento, Drupal, and Joomla. Security firm watchTowr said the flaws, tracked as CVE-2026-109618 and CVE-2026-109619, appear to affect every PHP version since PHP 5 in 2004 and that it has confirmed they are genuine.