PHP announced an out-of-cycle security release for October 21 to address two critical vulnerabilities that its security team rated 9.2 on the CVSS v4.0 scale. Security researchers at watchTowr said the flaws could allow remote code execution, potentially enabling attackers to run malicious commands on vulnerable servers. No exploitation had been reported at the time of writing.

AdvertisementThe Puranic

The announcement followed a leak on October 20 that mentioned two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, and assigned them a CVSS score of 10.0. However, PHP had not confirmed the leaked score or the claim that all versions from PHP 5 onward were affected. Researchers have informally called the flaws “php2shell.”

PHP said the official release would identify the affected versions and provide fixes. Updates were expected for its four supported branches: PHP 8.2, 8.3, 8.4 and 8.5, with anticipated release numbers 8.2.35, 8.3.36, 8.4.27 and 8.5.12. These numbers had not yet been officially confirmed at the time of writing. Older branches, including PHP 8.1, 8.0, 7.x and 5.x, are unsupported and do not receive security fixes from the PHP project.

The potential exposure is significant. Mallory identified around 884,000 internet-facing hosts reporting PHP 8.1 or older on Shodan as of October 20. This represented approximately 59% of hosts reporting a PHP version, although the figures do not confirm that these systems are vulnerable.

Before the fixes became available, security experts advised organisations to inventory their PHP installations, prepare to patch internet-facing systems first, and check hosting providers for security updates. Organisations using unsupported versions should consider upgrading or restricting public access. CERT-EU also recommended considering isolating internet-facing applications until a fix is available.

Administrators were urged to monitor unusual activity from PHP-related processes, preserve logs and investigate suspicious files or accounts if a compromise is suspected. Monitoring tools may help detect suspicious activity but do not prevent attacks.

Huntress and watchTowr reported no known exploitation as of October 20–21. The vulnerabilities’ exact scope, technical details and exploitation requirements remained unconfirmed pending PHP’s official release.