Critical PHP Vulnerabilities Leaked Ahead of Scheduled Security Patches

Two vulnerabilities that could affect the servers underlying many websites have been disclosed ahead of the planned security patches, leading major cybersecurity authorities to urge users to prepare for remediation.

The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively known as ‘PHP2Shell,’ were scheduled to be disclosed on October 21 at 2pm GMT.

However, a user named ‘petecooper’ published a post on the Hacker News forum on October 20 revealing the vulnerabilities’ CVE identifiers, which were supposed to be kept secret until the patches are available.

The post, now deleted, claimed that two maximum-severity (CVSS rating of 10.0) PHP remote code execution (RCE) vulnerabilities would be disclosed on October 22.

It also said that both vulnerabilities affected PHP versions dating back to PHP 5 and that exploiting them could allow remote code execution (RCE) and server takeover.

PHP is used by approximately 69.7% of websites whose server-side programming language is known, according to recent W3Techs data.

These include many content management systems (CMS) like WordPress, Drupal, Joomla and Magento as well as e-commerce and web services platforms.

Following the petecooper post, WatchTowr confirmed that CVE-2026-109618 and CVE-2026-109619 were scheduled to be disclosed later.

The disclosure was also scheduled to happen alongside the PHP security team releasing patches for both vulnerabilities.

Leaking information on critical vulnerabilities and some of their characteristics, such as the range of affected versions, ahead of an available patch can lead malicious actors to exploit them, for instance using reverse engineering techniques.

CERT-EU Urges PHP Users to Prepare for Patching

In a security bulletin, published on October 21, the PHP security team confirmed it was working on patches, which were scheduled to be released at 2pm GMT on October 21 – not on October 22 as claimed by the Hacker News forum user.

“We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild,” they added.

In addition, the PHP team allocated a critical severity rating (CVSS) of 9.2 rather than the maximum-severity score suggested by the individual sharing the leak.

Several cybersecurity authorities, including the Computer Emergency Response Team of the EU (CERT-EU) and th UK's National Cyber Security Centre (NCSC) also released emergency advisories, warning of upcoming patches for the two vulnerabilities.

CERT-EU advised organizations to prepare for immediate patching of affected assets.

“Where immediate patching is not feasible, organizations should consider isolating internet-facing applications from public networks until a fix is available,” CERT-EU added.

Inferring from PHP’s pre-release builds, Kevin Beaumont, an independent security researcher, said on Mastodon that fixed versions will likely be the following:

• 8.5.12
• 8.4.27
• 8.3.36
• 8.2.35