Critical PHP Vulnerabilities Leaked Ahead of Scheduled Security Patch
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively known as ‘PHP2Shell,’ were scheduled to be disclosed on October 21 at 2pm GMT.
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively known as ‘PHP2Shell,’ were scheduled to be disclosed on October 21 at 2pm GMT.
On October 20, details of two critical remote code execution (RCE) vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, leaked online before their coordinated disclosure and before patches were released.
Following the petecooper post, WatchTowr confirmed that CVE-2026-109618 and CVE-2026-109619 were scheduled to be disclosed later.
Since PHP released its security advisory this morning to address the two critical vulnerabilities, several researchers have come forward to release the technical details of the vulnerabilities: Calif's write-up provides a detailed history of PHP memory-limit vulnerabilities, and then explains how Calif revisited those earlier findings through OpenAI's Patch the Planet initiative, uncovering multiple interruption point and reliable RCE paths.
PHP is used by roughly 69.7% of websites whose server-side programming language is known, according to recent W3Techs data.
Leaking information on critical vulnerabilities and some of their characteristics, such as the range of affected versions, ahead of an available patch can lead malicious actors to exploit them, for instance using reverse engineering techniques.
Inferring from PHP’s pre-release builds , Kevin Beaumont, an independent security researcher, said on Mastodon that fixed versions will likely be the following: Update 4pm BST: The PHP security team has now published a security advisory for CVE-2026-109618 and CVE-2026-109619 which can be found here .
PHP has published a security update to address a critical security issue that may allow attackers to execute commands on any web server running PHP.
The NCSC is encouraging UK organisations to take immediate action to mitigate a security issue affecting PHP (CVE-2026-109618 and CVE-2026-109619).
Huntress is continuing to track developments related to CVE-2026-109618 and CVE-2026-109619.
What happened
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively known as ‘PHP2Shell,’ were scheduled to be disclosed on October 21 at 2pm GMT.
On October 20, details of two critical remote code execution (RCE) vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, leaked online before their coordinated disclosure and before patches were released.
What changed
Following the petecooper post, WatchTowr confirmed that CVE-2026-109618 and CVE-2026-109619 were scheduled to be disclosed later.
Since PHP released its security advisory this morning to address the two critical vulnerabilities, several researchers have come forward to release the technical details of the vulnerabilities: Calif's write-up provides a detailed history of PHP memory-limit vulnerabilities, and then explains how Calif revisited those earlier findings through OpenAI's Patch the Planet initiative, uncovering multiple interruption point and reliable RCE paths.
Who is affected
PHP is used by roughly 69.7% of websites whose server-side programming language is known, according to recent W3Techs data.
Leaking information on critical vulnerabilities and some of their characteristics, such as the range of affected versions, ahead of an available patch can lead malicious actors to exploit them, for instance using reverse engineering techniques.
Why it matters
Inferring from PHP’s pre-release builds , Kevin Beaumont, an independent security researcher, said on Mastodon that fixed versions will likely be the following: Update 4pm BST: The PHP security team has now published a security advisory for CVE-2026-109618 and CVE-2026-109619 which can be found here .
PHP has published a security update to address a critical security issue that may allow attackers to execute commands on any web server running PHP.
Technical details
The NCSC is encouraging UK organisations to take immediate action to mitigate a security issue affecting PHP (CVE-2026-109618 and CVE-2026-109619).
Huntress is continuing to track developments related to CVE-2026-109618 and CVE-2026-109619.
While the software itself in these deprecated versions will receive no official patch from the PHP maintainers, security researchers have produced their own patches that will permit admins to rebuild the PHP modules from source code.
Response
For those running the older, outdated versions of PHP (before the 8.2.x version numbers), it's likely there will be no official patch to resolve the vulnerabilities.
However, a user named ‘petecooper’ published a post on the Hacker News forum on October 20 revealing the vulnerabilities’ CVE identifiers, which were supposed to be kept secret until the patches are available.
What security teams should do
The disclosure was also scheduled to happen alongside the PHP security team releasing patches for both vulnerabilities.
Several cybersecurity authorities, including the Computer Emergency Response Team of the EU (CERT-EU) and th UK's National Cyber Security Centre (NCSC) also released emergency advisories, warning of upcoming patches for the two vulnerabilities.
Attribution
Infosecurity Magazine: The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively known as ‘PHP2Shell,’ were scheduled to be disclosed on October 21 at 2pm GMT.
Huntress: On October 20, details of two critical remote code execution (RCE) vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, leaked online before their coordinated disclosure and before patches were released.
NCSC-UK: The NCSC is encouraging UK organisations to take immediate action to mitigate a security issue affecting PHP (CVE-2026-109618 and CVE-2026-109619).
What to watch next
Watch for updated vendor guidance and fixed-version details.