PHP to Issue Patches for CVE-2026-109618 and CVE-2026-109619 at 9.2 Severity
Two CVEs rated 9.2 affect all PHP versions since 2004. Patches release within 12 hours unless early exploitation forces an earlier drop. Web administrators must stage upgrades immediately across WordPress, Drupal, Laravel and other major platforms.
PHP project maintainers issued an advisory on Monday announcing patches for CVE-2026-109618 and CVE-2026-109619. Both vulnerabilities carry CVSS 9.2 ratings. The advisory directed all users to prepare upgrade paths immediately. Maintainers stated they would advance the release if exploit details surfaced publicly or if in-the-wild exploitation appeared.
A leaked video demonstrated a tool named PHP2Shell achieving remote code execution against WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, multiple Laravel and Symfony releases, Drupal 11.4.10, and WHMCS 9.0.9. WatchTowr confirmed the CVEs are valid and stated the flaws trace back to PHP 5 released in 2004. No public exploit code has been located yet.
The scope spans nearly all active PHP deployments because the affected code paths exist across two decades of releases. Web administrators running any listed application face immediate exposure once details circulate. Standard patching windows measured in days become irrelevant; zero-day response procedures apply instead.
Operators should stage updated binaries now, test rollback procedures, and monitor the PHP mailing list and CVE feeds for an earlier drop. Systems without automated update pipelines require manual intervention within hours of release.
PHP Security Team: Active exploitation evidence appears within 48 hours, triggering immediate patch release ahead of schedule.
Sources (2)
- [1]Ars Technica Security Report(https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches/)
- [2]watchTowr Vulnerability Confirmation(https://labs.watchtowr.com/php2shell-cve-2026-109618-109619/)