AI Image
PHP Warns of Two Critical 9.2 Security Vulnerabilities, Urges Users to Prepare for Patches
CyberSecurityNews • • world
Key Points:
- The PHP security team has announced two critical vulnerabilities with a CVSS v4.0 score of 9.2, scheduled for patch release on October 21, 2026, urging administrators to prepare promptly.
- The vulnerabilities, linked to CVE-2026-109618 and CVE-2026-109619, are described as remote code execution flaws potentially allowing attackers to execute code on affected servers, though detailed technical information remains pending.
- Early reports and advisories, including from CERT-EU and security firm watchTowr, highlight possible exploitation risks and recommend immediate identification and isolation of vulnerable PHP applications until patches are applied.
- Cloudflare has observed early exploitation attempts following the leak of vulnerability details, leading PHP to issue emergency patches for the so-called php2shell flaws threatening millions of web servers.
- Administrators are advised to confirm management and update procedures for PHP installations, apply patches promptly upon release, and avoid assuming safety based on unverified configurations or previous PHP fixes.
