Critical Vulnerabilities Identified in PHP: Urgent Patch Release Imminent
The PHP security team has issued a stark warning regarding two significant vulnerabilities, urging site administrators to brace for an imminent security update.
Both vulnerabilities bear a CVSS v4.0 score of 9.2, indicating their critical nature. The scheduled release time is set for Wednesday, October 21, 2026, at 14:00 UTC, thereby allowing website operators and hosting providers a brief period to take preparatory measures.
In an official security announcement dated October 20, PHP disclosed intentions to provide comprehensive technical details, impacted versions, and corrective updates along with the patches.
Should either vulnerability be disclosed publicly or evidence of active exploitation emerge, the team may expedite the release timeline.
Reports in the public domain attribute the forthcoming patches to CVE-2026-109618 and CVE-2026-109619.
The cybersecurity firm watchTowr characterizes these issues as remote code execution vulnerabilities, potentially enabling malicious actors to execute arbitrary code on compromised servers.
However, PHP’s prior communication refrains from naming the CVEs or elucidating the nature of the vulnerabilities.
A warning from CERT-EU also highlights these vulnerabilities, indicating a risk of remote code execution without authentication.
This advisory partially relies on leaked data, necessitating that administrators differentiate between this information and the confirmed facts released by PHP.
Initial analyses suggest that these vulnerabilities could impact versions of PHP ranging from 5 onwards; however, this assertion has yet to receive verification from the vendor.
PHP has not clarified whether default installations are susceptible, nor specified which configurations or operating systems might face heightened risks.
While some early assessments indicated a maximum severity of 10.0, PHP officially rated each vulnerability at 9.2 under CVSS v4.0.
This official rating should serve as the benchmark for reporting until more conclusive details are revealed regarding the inherent risks and conditions for potential exploitation.
Update 1: A publicly available proof-of-concept repository offers verification tools and a laboratory setup for testing the two critical PHP vulnerabilities now identified as php2shell.
Update 2: Cloudflare has reported observing preliminary attempts to exploit the two critical vulnerabilities in PHP, details of which surfaced prior to the PHP security team’s intended announcement.
Update 3: PHP has released emergency patches addressing the php2shell vulnerabilities that pose significant threats to millions of web servers.
PHP to Issue Emergency Patch
At the time of the announcement, watchTowr indicated no known exploitation in the wild. PHP’s caution regarding a potential early release serves as a preventive measure rather than confirmation of active attacks.
Allegations involving leaked demonstrations or exploit code should not be misconstrued as evidence of assaults on actual targets.
Historical precedents underscore the necessity for swift action by administrators. Cybersecurity News documented real-time exploitation of CVE-2024-4577, a dissimilar PHP vulnerability, with attempts detected within 24 hours of its disclosure.
While this context underscores the importance of prompt patching, it does not confirm active exploitation of the newly identified vulnerabilities.
Earlier in 2026, publication also addressed vulnerabilities in the PHP SOAP extension that involved different issues and resolutions.
Administrators should remain cautious and not assume that applying patches for earlier vulnerabilities will suffice to address the forthcoming release’s concerns.
CERT-EU advises organizations to identify PHP applications at risk and prepare to implement patches as soon as fixed versions are accessible.
In instances where immediate updates are unfeasible, it may be prudent to isolate internet-facing applications from public networks until a remedy can be applied, taking into account service availability and organizational needs.
Utilizing the preparation period, teams should ascertain who oversees each PHP installation and the protocols for rolling updates into production systems.
Upon the release of the updates, administrators ought to consult the official list of affected versions, promptly apply the necessary corrections, and verify the PHP version in operation.
Until then, no deployment should be considered secure merely due to its configuration differing from circulating claims.
Source link: Cybersecuritynews.com.
