Latest
Category 2 Hurricane Isaias nears landfall, leading to production shut-insRace for crucial midterms attracting vast sums of money on both sides | First ThingTrump calls for data center ‘dividends’ in bid to win over midterm voters – US politics liveOpenAI Invests in Startup That Uses Brain Implants to Detect CancerRussia releases imprisoned U.S. citizen Stephen Hubbard following Trump's request‘What are you implying?’: El-Sayed confronts critics head-on as attacks ramp up‘Hunted like animals’: inside Trump’s war on the people who build AmericaCategory 2 Hurricane Isaias nears landfall, leading to production shut-insRace for crucial midterms attracting vast sums of money on both sides | First ThingTrump calls for data center ‘dividends’ in bid to win over midterm voters – US politics liveOpenAI Invests in Startup That Uses Brain Implants to Detect CancerRussia releases imprisoned U.S. citizen Stephen Hubbard following Trump's request‘What are you implying?’: El-Sayed confronts critics head-on as attacks ramp up‘Hunted like animals’: inside Trump’s war on the people who build America
← Signal: Tech & AI

PHP to release emergency patches for two critical vulnerabilities affecting all versions since 2004

Developing1 source · Oct 21, 2026

PHP maintainers plan to release fixes within 12 hours for two vulnerabilities rated 9.2 severity that allegedly affect major web platforms.

PHP to release emergency patches for two critical vulnerabilities affecting all versions since 2004
Image via Ars Technica

What happened

PHP maintainers announced Monday they will release emergency patches for two critical vulnerabilities, both rated 9.2 out of 10 in severity. The patches are scheduled to release within approximately 12 hours of the announcement. Purported details of the vulnerabilities were leaked online, showing a video of an exploit tool called PHP2Shell executing code on web servers running multiple major platforms including WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symphony 8.1.9, Drupal 11.4.10, and WHMCS 9.0.9. Security firm watchTowr confirmed the vulnerabilities (CVE-2026-109618 and CVE-2026-109619) are real and stated the leaks claimed they affect every PHP version from PHP 5 onward, spanning back to 2004.

Context

PHP powers websites and web applications globally, making these vulnerabilities potentially consequential for a large installed base. The severity ratings of 9.2 indicate unusually dangerous flaws. The maintainers explicitly reserve the right to accelerate the release if exploitation evidence emerges or details become more widely public, suggesting concern about active weaponization. The existence of circulating exploit video and the breadth of affected platforms amplifies urgency for administrators to prepare and deploy patches immediately upon release.

What's disputed

The original leaked report containing purported vulnerability details has not been confirmed and could not be located by the reporting outlet; however, security researchers have independently verified the vulnerabilities are genuine.