PHP to Release Emergency Patches for "Severe Vulnerabilities"
PHP maintainers announced they will release emergency patches for two critical vulnerabilities that could affect websites and applications.
PHP developers are preparing to release emergency patches for two critical security vulnerabilities affecting websites and applications. Both flaws have been assigned a high severity rating of 9.2 out of 10. Maintainers have urged all PHP users to prepare for immediate upgrades as soon as the patches become available.
Highlights
- PHP maintainers plan to release emergency patches for two critical vulnerabilities.
- The vulnerabilities are rated with a severity score of 9.2 out of 10.
- An exploit tool, "PHP2Shell," is reportedly capable of executing code on popular platforms like WordPress, MediaWiki, and Joomla.
- A security firm has confirmed the vulnerabilities and warns that mass attacks could begin rapidly after the patches are released.
- Users are encouraged to back up their systems and update immediately once the patches are available.
Details
PHP maintainers issued an advisory following the leakage of purported details regarding potential vulnerabilities. Unconfirmed reports claim an exploit tool dubbed "PHP2Shell" can execute code on various web servers running PHP, including WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, and Drupal 11.4.10. While these claims are unconfirmed, security firm watchTowr has verified that the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are real.
Researchers from another security firm, Sansec, stated they "expect mass attacks to start within 15 minutes of the release." Experts recommend that organizations identify all applications built on PHP, back up site and database files, and monitor the PHP.net homepage for updates. Some suggest unplugging non-essential systems until they are patched.
Why it matters
PHP is a widely used open-source scripting language for building dynamic websites and web applications. An estimated 1.3 million Internet-connected hosts are potentially affected. Vulnerabilities of this severity have the potential to inflict major damage across the Internet. Therefore, it is crucial for web administrators and developers to apply these emergency patches immediately.