PHP2Shell Leak Forces Emergency Patch Release for Critical RCE Flaws
Two critical PHP vulnerabilities, dubbed 'PHP2Shell,' were leaked before their scheduled disclosure, prompting an emergency patch release at 14:00 UTC on October 21. The flaws, rated 9.2 on the CVSS v4.0 scale, allow remote code execution and affect approximately 70% of websites using server-side scripting. While no active exploitation has been confirmed, security authorities urge immediate preparation for patching, particularly for internet-facing systems.
Key points
- CVE-2026-109618 and CVE-2026-109619 were leaked on October 20 via a Hacker News post, revealing details ahead of the planned October 22 disclosure.
- PHP maintainers accelerated the patch release to October 21 at 14:00 UTC, with fixed versions expected for branches 8.2 through 8.5.
- The vulnerabilities are rated 9.2 on the CVSS v4.0 scale by PHP, though the leak claimed a maximum 10.0 severity.
- CERT-EU and the UK NCSC issued emergency advisories, recommending isolation of internet-facing applications if immediate patching is not feasible.
- No active exploitation has been reported as of October 21, but researchers warn mass attacks could begin within 15 minutes of the patch release.
Background
PHP is a foundational technology for the web, powering approximately 69.7% of websites with known server-side languages, including major CMS platforms like WordPress and Drupal. Previous incidents, such as the 2024 CVE-2024-4577 flaw, demonstrated rapid exploitation following public disclosure, highlighting the critical need for timely patching in widely used software.
How outlets are covering it
Infosecurity Magazine emphasizes the urgency of CERT-EU and NCSC advisories, noting that leaked details could enable reverse engineering attacks. Ars Technica highlights the breadth of affected applications, listing specific versions of WordPress, Magento, and Laravel in a leaked exploit video, while noting that the 10.0 CVSS score from the leak is unconfirmed. The Hacker News provides a technical breakdown, clarifying that only PHP 8.2-8.5 will receive patches, leaving end-of-life versions unpatched, and details specific preparation steps for administrators, including inventorying PHP installations and monitoring for anomalous process launches.
Why it matters
The premature leak of critical vulnerabilities in a ubiquitous technology like PHP poses a significant risk to global web infrastructure. The accelerated patch timeline and emergency advisories from major cybersecurity authorities underscore the potential for widespread exploitation, requiring immediate action from organizations to mitigate risks and protect internet-facing systems.
What to watch
PHP maintainers are expected to release patches at 14:00 UTC on October 21, with full details on affected versions and technical specifics to be published alongside the release. Administrators are advised to monitor PHP.net for updates, prepare maintenance windows, and implement isolation measures for unpatched systems. Security firms will closely monitor for signs of active exploitation in the hours following the patch release.
- Critical PHP Vulnerabilities Leaked Ahead of Scheduled Security Patches Infosecurity Magazine
- Government websites go dark as vulnerabilities in programming language send shudder across internet Reuters
- Exclusive | AI Just Found A Bug That Puts Up to 70% of the World’s Websites at Risk WSJ
- PHP warns it plans to release 2 emergency patches imminently Ars Technica
- PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert The Hacker News
Want the full story? Read the original reporting
Read on Infosecurity Magazine