PHP will ship an out-of-cycle security release at 14:00 UTC on October 21 to address two critical vulnerabilities its security team has rated 9.2 on the CVSS v4.0 scale, the project said. Security researchers at watchTowr say the two flaws allow remote code execution; PHP had not published technical details or fixed versions at the time of writing.
What PHP said and the disclosure timeline
PHP published a notice on October 20 at 19:33 UTC announcing the unscheduled release for Wednesday and warning it may publish earlier “should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.” The project did not name the vulnerabilities in that notice; it said that “Full details, affected versions, and the fixed versions will be published with the release.” Researchers have begun calling the pair php2shell, a name not used by PHP.
The advance notice followed a leak. On October 20, a post on Hacker News claimed two PHP remote code execution flaws rated CVSS 10.0 and affecting versions from PHP 5 onward would be disclosed on October 22. The poster said they had “no evidence beyond ‘source: trust me, bro’.” watchTowr then confirmed on X that the leaked information was real, that the flaws were under embargo, and that it could not share more until the planned disclosure.
CVE identifiers, scores and scope
Researchers have been using CVE-2026-109618 and CVE-2026-109619 for the two issues; PHP’s notice named neither identifier. The 10.0 CVSS score came from the leaked post; PHP’s security team rated the pair 9.2 on CVSS v4.0. The leaked post included a score, date and two CVE identifiers but did not describe how the flaws work. watchTowr’s FAQ says the scope “has not been confirmed by an official vendor advisory” and that no configuration or feature requirement has been described.
Which PHP branches can be fixed
PHP will ship fixes only for its four supported branches: 8.2 through 8.5. The project records each branch’s changes in its changelog. As of the September 24 releases cited by PHP, the branches and support statuses are:
– 8.5 — current release 8.5.11 — Active support until December 31, 2027
– 8.4 — current release 8.4.26 — Active support until December 31, 2026
– 8.3 — current release 8.3.35 — Security fixes only until December 31, 2027
– 8.2 — current release 8.2.34 — Security fixes only until December 31, 2026
Trackers including Alpine Linux and security researcher Kevin Beaumont expect the fixes to ship as PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (the next point release of each branch), but PHP had not confirmed those version numbers ahead of the release.
Anything older — including 8.1, 8.0, 7.x and 5.x — is end of life and will receive no vendor patch. If the flaws affect those branches, installations running EOL versions will have no PHP vendor fix.
Exposure estimates and exploitation status
Security company Mallory counted about 884,000 internet-facing hosts whose HTTP banner reported a PHP version of 8.1 or older to the Shodan search engine on October 20, representing 59% of the roughly 1.5 million hosts that reported any PHP version. The count covers banners, not confirmed affected systems; a further 740,000 hosts reported PHP without a version.
As of October 20–21, researchers reported no confirmed exploitation. Huntress said it had not seen exploitation in its partner environments, had not built or reproduced a proof of concept, and was not aware of public exploit code. watchTowr’s FAQ listed exploitation as none reported as of October 21 and said the flaws were not in CISA’s Known Exploited Vulnerabilities catalog. For context, when CVE-2024-4577 (a PHP flaw in CGI mode on Windows) became public in June 2024, Akamai observed exploit attempts against its honeypots within 24 hours.
Immediate mitigation and preparation steps
Until PHP publishes the release, recommended preparation steps compiled from Huntress and CERT-EU are:
– Inventory every PHP install, including PHP bundled in vendor appliances, Windows software, and control panels such as cPanel and Plesk.
– Be ready to upgrade at 14:00 UTC on October 21 and patch internet-facing systems first.
– Check your Linux distribution and hosting provider for backported packages.
– For end-of-life branches, either upgrade, take the system off the internet, or place it behind a VPN or web application firewall until a fix is available. CERT-EU advises “consider isolating internet-facing applications from public networks until a fix is available.”
– Monitor for processes: watch for php-fpm, php-cgi, httpd or apache2 launching shells, interpreters, or download tools.
– Where endpoint detection is lacking, Florian Roth’s process-watcher can log every program a PHP process starts (Roth notes it “prevents nothing” because it sees programs only after they have started).
If signs of compromise appear, isolate the server, preserve web server and PHP logs, and look for web shells, new files in web roots, new cron jobs or scheduled tasks, and unusual accounts.
The forthcoming PHP release should clarify which versions are affected, which part of PHP is involved, and whether exploitation requires a particular runtime mode, configuration or login. At the time of writing, PHP had not yet released the fixes.
