AI Image
PHP warns it plans to release 2 emergency patches imminently
Ars Technica • • business
Key Points:
- PHP maintainers plan to release patches within 12 hours for two critical vulnerabilities rated 9.2 out of 10, urging all users to prepare for immediate upgrades.
- The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, reportedly affect all PHP versions from 5 onward and have been confirmed by multiple security firms.
- An exploit tool named PHP2Shell has been shown executing code on popular PHP-based applications like WordPress, MediaWiki, Magento, Joomla, Laravel, and Drupal, raising concerns about widespread impact.
- Security experts warn of imminent mass attacks shortly after patch release and recommend admins to inventory PHP applications, schedule maintenance windows, back up data, and monitor official PHP announcements closely.
- Given PHP’s extensive use across the web, with an estimated 1.3 million hosts affected, these vulnerabilities pose a significant threat, prompting some experts to advise disconnecting non-essential systems until patched.
