Details of two critical PHP flaws leak before patches, and PHP tells users to get ready to upgrade
The bugs, nicknamed PHP2Shell, carry a CVSS score of 9.2. Fixes are scheduled for October 21 at 14:00 UTC.
Evidence: Official disclosure. Security stories run only with a named disclosure or independent reporting behind them.
Details of two critical vulnerabilities in PHP have leaked online before coordinated disclosure and official patches, according to SecurityWeek. The flaws are reportedly tracked as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS scale, and public reporting calls them PHP2Shell, suggesting attackers could use them to get shells on vulnerable servers. On Tuesday, PHP said patches were planned for Wednesday, October 21, at 14:00 UTC and urged all users to prepare to upgrade as soon as the release is available. It added that fixes could ship earlier if technical details are published or if exploitation in the wild is seen. Based on the scores, CERT-EU says both bugs could be exploited without authentication and could lead to remote code execution. SecurityWeek notes that the public details so far do not include a root cause, an affected component or an attack path. Security Affairs and The Hacker News also reported on the emergency fixes. PHP runs on a very large share of web servers, so administrators and hosting providers face a short window between the leak and the patch, and SecurityWeek warns that mass exploitation may follow.