Update, 10/21/2026, 9:55 a.m.: The patches have been released, with fixes shipped as versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, covering the supported branches, 8.2 through 8.5. Our original story is below.
The PHP project is preparing an unscheduled security release for Wednesday to fix two vulnerabilities it rates as critical after details of the flaws leaked online and a major internet infrastructure company reported early attacks.
The patch release, set for 10 a.m. EDT Wednesday, addresses two flaws catalogued as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 severity scale, which tops out at 10. Researchers describe them as remote code execution vulnerabilities, which could let an attacker run their own code on a server and potentially take control of it.
The vulnerabilities have been dubbed “php2shell” by researchers.
Neither the technical cause nor a complete list of affected versions has been officially confirmed, with the PHP team saying full details will be published with the release. An advisory from CERT-EU, the European Union’s computer emergency response team, says the flaws could affect every version of PHP from 5 onward.
The security firm watchTowr said Tuesday the vulnerabilities had been set for release Thursday under embargo. The PHP team moved the release up a day and said it could act sooner still if details became public or exploitation appeared.
A video demonstrating an exploit chain spread online overnight via researcher Kirill Firsov, who shared it and credited researchers known as LCFR and Calif.io. watchTowr said it had reproduced one of the flaws. Code claiming to exploit the flaws is circulating but has not been verified, and security firms caution such code is sometimes laced with malware.
Dane Knecht, chief technology officer at Cloudflare, said Wednesday the company was “seeing early attacks emerging” and updating its defenses as new vectors appeared. Cloudflare deployed firewall rules covering known exploit vectors to all customers, including free accounts, while calling the protection “a stopgap.”
The potential exposure is broad. PHP runs between 70-80% of websites whose server-side language is known, according to market research, and underpins platforms including WordPress, Drupal, Joomla and Laravel. Researchers estimated more than 1.3 million internet-exposed hosts could be vulnerable, and a Shodan search counted about 1.9 million. Among servers that disclose their version, most run branches are no longer receiving security updates: about 758,000 run versions from 5.4 through 8.1, compared with 272,000 on supported branches, according to VirusTotal.
CERT-EU and Britain’s National Cyber Security Centre advised organizations to prepare to update systems quickly and suggested isolating internet-facing applications where immediate patching was not feasible. PHP flaws have been exploited before: the U.S. Cybersecurity and Infrastructure Security Agency’s known-exploited vulnerability catalog lists three in PHP itself, two used in ransomware campaigns.
More information is expected over the course of the day. The PHP team is to publish the full advisory with the release, and security firms including Huntress and Tenable said they would update their analyses as technical details and proof-of-concept code emerge.
