Brief
PHP maintainers warn of critical patches for severe vulnerabilities
Two high‑severity PHP flaws will be patched within half a day, with advisory urging immediate preparation.
By Felo News Desk · Published
PHP maintainers announced on Monday that patches for two critical vulnerabilities, each rated 9.2 out of 10, will be released in just over 12 hours. The advisory, titled “Waiting for PHP2Shell,” urges all PHP users to ready their systems for an immediate upgrade and notes the right to release earlier if details become public or active exploitation is observed.
The vulnerabilities, tracked as CVE‑2026‑109618 and CVE‑2026‑109619, affect every PHP version from PHP 5 onward, according to security firm watchTowr. A video of an exploit tool called PHP2Shell shows code execution on a range of applications, including WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symphony 8.1.9, Drupal 11.4.10 and WHMCS 9.0.9.
Key facts
- PHP maintainers plan to release patches for two 9.2‑severity vulnerabilities within about 12 hours. (arstechnica.com)
- The vulnerabilities are identified as CVE‑2026‑109618 and CVE‑2026‑109619. (arstechnica.com)
- watchTowr says the flaws affect every PHP version from PHP 5 (2004) onward. (arstechnica.com)
- A video of the exploit tool PHP2Shell shows it targeting multiple popular PHP‑based applications. (arstechnica.com)
Sources
- [1] arstechnica.com — originally reported as “PHP maintainers tell Web devs to prepare themselves for critical security patches”
