PHP's maintainers warned on Monday that they will soon ship emergency fixes for two vulnerabilities, each rated 9.2 out of 10 for severity. PHP quietly runs a large share of the web, including many company sites and customer portals, so if your website, shop or internal tool runs on it, you should be getting ready now.
The advisory told all PHP users to prepare so they can upgrade the moment the release is out. The maintainers also said they reserve the right to release earlier if details become public or if attacks appear in the wild.
What is confirmed and what isn't
The advisory followed the leak of purported details, which haven't been confirmed. That report showed a video of a tool called PHP2Shell running code on servers using WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symphony, Drupal and WHMCS. Ars Technica couldn't find the original report.
Security firm watchTowr said the report claimed every PHP version from PHP 5 (released in 2004) onward is affected. The firm also said it has confirmed the two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, are real. The exploit video and the PHP 5 claim remain unverified until the patches and official details land.
How fast attackers may move
Researchers at Sansec said they expect mass attacks to begin within 15 minutes of the release. Webfence urged admins to prepare, and Huntress has issued its own advisory. Ars Technica's report also cited an estimate of about 1.3 million internet-connected hosts being likely affected, but it did not name the researcher or firm behind that figure, so treat it with caution.
The preparation list is practical. Work out who owns PHP in your organization, inventory every app built on it, and plan a maintenance window starting at 14:00 UTC, with a fallback in case the release comes earlier. Back up site and database files, and watch the PHP.net homepage for announcements. Some experts suggest unplugging non-essential systems until they're patched.
What we don't know yet
The exact release time, the technical nature of the bugs and the full list of affected versions were not spelled out in the coverage we reviewed. Until the patch ships, details stay thin.
Next up: the PHP release itself, which could come at any moment. Are you ready to patch within the hour, or would a surprise release catch your team off guard?
Sources
- 1.PHP warns it plans to release 2 emergency patches imminently · Ars Technica
Reported by the WattsUpNext desk from the sources linked below. Spot an error? Tell us at corrections@wattsupnext.com.
The WattsUpNext Brief
Get stories like this in your inbox.
One email each weekday, only the topics you choose. Real news, sourced, no fluff. Unsubscribe in one click.
