Two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each carry a severity rating of 9.2 out of a possible 10, and PHP maintainers have scheduled emergency fixes. Dan Goodin reported at Ars Technica that, when his report was published early on Oct 21, the release was a little more than 12 hours away.
The maintainers’ advisory left little room for slow change control: “All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available.” It added: “We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.”
The purported exploit is called PHP2Shell. A leaked report claims that it can remotely execute code on PHP sites. Remote code execution means that someone reaching a site over the network can make code run on its server; if that claim is validated, the vulnerable component would turn a request into execution rather than merely exposing a page or leaking data.
What the leaked report claims to show
The maintainers published the advisory after purported vulnerability details leaked. Ars could not locate the original report and has not confirmed those details. The circulating material includes a video of PHP2Shell executing code on web servers. A demonstration establishes that code ran in that demonstration; it does not by itself establish the underlying PHP bug, the complete affected range or reliability against differently configured installs.
The listed demonstration versions are WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symphony 8.1.9, Drupal 11.4.10 and WHMCS 9.0.9. All run on PHP. Their appearance is evidence about the breadth of the claimed test set, not automatically evidence that each application introduced a separate vulnerability.
That distinction matters operationally. A flaw in PHP can reach applications written by different organizations because each one delegates request handling to the same language runtime. A flaw specific to WordPress and another specific to Magento would require different patch paths. The leaked material points instead to one claimed dependency chain: PHP2Shell → an installation running PHP → code executed on the web server.
What is confirmed and what is not
Security firm watchTowr says the leaked report claims to affect every PHP version from PHP 5, released in 2004, onward. Read literally in 2026, that is a 22-year span. But watchTowr’s confirmation is narrower and more useful: it says CVE-2026-109618 and CVE-2026-109619 are real. The existence of the two vulnerabilities is confirmed; the claim about every released version remains an unconfirmed part of the leaked report.
The pair of CVE numbers also shows that the emergency release concerns two separately tracked issues. It does not mean every server is exposed to both in the same way. Until the maintainers publish version ranges and technical descriptions, the size of the exploitable population cannot be calculated from the 9.2 scores alone.
The advisory followed the circulation of purported details, but the maintainers still reserved the option of moving the release earlier if either vulnerability is fully disclosed or if exploitation appears. Those are separate triggers: technical disclosure makes attacks easier to reproduce, while evidence of active exploitation establishes that at least one attacker has already crossed that threshold.
The operational constraint
For operators, “prepare now” reduces to three pieces of data: the PHP version on each host, the package or build path that normally replaces it, and the application versions that must still run after PHP changes. The leaked list crosses content-management systems, forums, commerce systems, frameworks and administrative software, so asset inventories that record applications without runtimes may miss the common dependency.
The next useful numbers are the exact affected releases, the corresponding fixed releases and any exploitation count independent researchers can reproduce. A 9.2 score says why the release is urgent, but the version ranges will determine how large the patching problem actually is.