Prepare yourselves: PHP to release emergency fixes for 2 critical vulnerabilities

The project overseeing the programming language is releasing patches Wednesday, with the internet racing to patch the 9.2 rated flaw.

The PHP project is preparing an unscheduled security release for Wednesday to fix two vulnerabilities it rates as critical after details of the flaws leaked online and a major internet infrastructure company reported early attacks.

The patch release, set for 10 a.m. EDT Wednesday, addresses two flaws catalogued as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 severity scale, which tops out at 10. Researchers describe them as remote code execution vulnerabilities, which could let an attacker run their own code on a server and potentially take control of it. 

The vulnerabilities have been dubbed “php2shell” by researchers.

Neither the technical cause nor a complete list of affected versions has been officially confirmed, with the PHP team saying full details will be published with the release. An advisory from CERT-EU, the European Union’s computer emergency response team, says the flaws could affect every version of PHP from 5 onward. 

The security firm watchTowr said Tuesday the vulnerabilities had been set for release Thursday under embargo. The PHP team moved the release up a day and said it could act sooner still if details became public or exploitation appeared.

A video demonstrating an exploit chain spread online overnight via researcher Kirill Firsov, who shared it and credited researchers known as LCFR and Calif.io. watchTowr said it had reproduced one of the flaws. Code claiming to exploit the flaws is circulating but has not been verified, and security firms caution such code is sometimes laced with malware.

Dane Knecht, chief technology officer at Cloudflare, said Wednesday the company was “seeing early attacks emerging” and updating its defenses as new vectors appeared. Cloudflare deployed firewall rules covering known exploit vectors to all customers, including free accounts, while calling the protection “a stopgap.” 

The potential exposure is broad. PHP runs between 70-80% of websites whose server-side language is known, according to market research, and underpins platforms including WordPress, Drupal, Joomla and Laravel. Researchers estimated more than 1.3 million internet-exposed hosts could be vulnerable, and a Shodan search counted about 1.9 million. Among servers that disclose their version, most run branches are no longer receiving security updates: about 758,000 run versions from 5.4 through 8.1, compared with 272,000 on supported branches, according to VirusTotal.

CERT-EU and Britain’s National Cyber Security Centre advised organizations to prepare to update systems quickly and suggested isolating internet-facing applications where immediate patching was not feasible. PHP flaws have been exploited before: the U.S. Cybersecurity and Infrastructure Security Agency’s known-exploited vulnerability catalog lists three in PHP itself, two used in ransomware campaigns.

More information is expected over the course of the day. The PHP team is to publish the full advisory with the release, and security firms including Huntress and Tenable said they would update their analyses as technical details and proof-of-concept code emerge.

Government

• DOJ escalates fight for election supremacy with California raids

• Wyden seeks adoption of encryption tech at hundreds of federal agencies to protect visitors’ sensitive traffic

• DHS to ban DeepSeek from federal civilian agencies

• Federal agencies recommend cyber controls, independent testing for frontier AI systems

Technology

• The next election influence campaign will target your AI chatbot

• Senators press Trump admin to rally federal government around AI safety, security 

• Anthropic rolls out program for ‘long-term commitment’ to secure critical infrastructure, open source software

• DOJ, FBI seize Flax Typhoon-linked hacking tools Microscan, FishHub

Threats

• Prolific Chinese espionage group exploits BeyondTrust zero-day

• AdFection: How mercenary spyware invades victims’ devices through targeted advertising

• Authorities charge alleged OLVX cybercrime marketplace operator in North Macedonia

• Microsoft drops an actively exploited zero-day among record high of 1,413 vulnerabilities

Policy

• FTC says ‘sextortion’ protection companies deceived customers about services 

• Major rules for federal contractors handling sensitive data are nearing the finish line

• FBI, French authorities seize deepfake CSAM-for-sale websites 

• Wiretapping change sparks big privacy fight in the Golden State