AI Image
Critical PHP Vulnerabilities Leaked Ahead of Scheduled Security Patch
Infosecurity Magazine • • general
Key Points:
- Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively called ‘PHP2Shell,’ were prematurely disclosed online ahead of scheduled patches, raising concerns over potential exploitation.
- The flaws affect PHP versions dating back to PHP 5 and could allow remote code execution and server takeover, impacting approximately 69.7% of websites using PHP, including major CMS and e-commerce platforms.
- The PHP security team confirmed working on patches set for release on October 21 at 2pm GMT, assigning a critical severity rating of 9.2, slightly lower than the initially claimed maximum severity of 10.0.
- Cybersecurity authorities such as CERT-EU and the UK's NCSC issued emergency advisories urging organizations to prepare for immediate patching or, if not feasible, to isolate affected internet-facing applications until fixes are deployed.
- The premature leak increases the risk of exploitation by malicious actors, prompting the PHP team to reserve the right to release patches earlier if public details or active attacks emerge.
