Unconfirmed report claims PHP2Shell exploit remotely executes code on PHP sites.
Credit: Getty Images
Website admins, brace yourselves. Fixes for what are believed to be uncommonly severe vulnerabilities are scheduled to drop in a little more than 12 hours for PHP, a programming language that powers websites and Web applications everywhere.
PHP maintainers said Monday that they planned to release patches for two vulnerabilities, both with severity ratings of 9.2 out of a possible 10.
Waiting for PHP2Shell
“All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available,” the advisory stated. “We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.”
The maintainers published the advisory following the leaking of purported details, which have yet to be confirmed. The report showed a video of an exploit tool dubbed PHP2Shell executing code on webservers running:
- WordPress 7.1.3
- MediaWiki 1.46.2
- phpBB 3.3.17
- Magento 2.4.9
- Joomla 6.2.0
- Laravel 13.36.0
- Laravel 8.83.29
- Symphony 8.1.9
- Drupal 11.4.10
- WHMCS 9.0.9
All of the above use PHP. A video depicting the tool has been reposted here.
Attempts to locate the unconfirmed report were unsuccessful, but security firm watchTowr said it claimed to affect every PHP version from PHP 5, released in 2004, onward. The security firm went on to say it has confirmed that the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are real.
Researchers from another security firm, Sansec, said they “expect mass attacks to start within 15 minutes of the release.” A third security firm, Webfence, also urged admins to prepare now. Huntress has also issued an advisory.
Preparation steps include identifying who is responsible for managing PHP inside an organization, taking an inventory of every app built on the language, planning a maintenance window starting at 14:00 UTC with contingency plans for moving earlier, making a backup of site and database files, and monitoring the PHP.net homepage for any late-breaking announcements, including an earlier release time. Some experts suggest unplugging any nonessential systems until they’re patched.
As an open source scripting language for building dynamic websites and web apps, PHP has come to be a de facto building block for the Web. It runs multiple CMS apps in addition to WordPress and also powers many internal tools. One security researcher said an estimated 1.3 million Internet-connected hosts are likely affected. Vulnerabilities with the severity the advisories are describing have the potential to inflict major damage across the Internet. Admins should remain aware that the patches can be released at any moment and remain vigilant until they are.
Update: Source file fixes were added to the php-src Github repo at 13:34 UTC this morning, with advisories here and here. Packages and docker images have begun filtering out as maintainers get their hands on the new sources. Our advice is unchanged from earlier: update as soon as possible.
