Vulnerabilities · Application Security
Critical PHP Flaws Leak: Mass Attacks Possible as Patches Near Release
Two critical PHP vulnerabilities, dubbed PHP2Shell, have leaked ahead of official patches. Security experts warn mass exploitation could begin within minutes of patch release.
Ross Grant3 min read
The short version
Two serious security flaws in PHP have been leaked before official fixes are ready. These flaws could let attackers take over web servers running PHP. Security experts warn that mass attacks could start soon after the patches are released. Website owners should prepare to update PHP as soon as possible.
What happened?
Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have leaked online before patches were available. Security experts warn these flaws could allow attackers to take over servers. Patches are scheduled for release on 21 October 2026.
What are the PHP2Shell vulnerabilities?
Two critical security flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, have been leaked online before official patches are available. These vulnerabilities are collectively referred to as "PHP2Shell" in public reporting. According to SecurityWeek (opens in a new tab), both flaws have a CVSS score of 9.2, which means they are considered highly severe.
Who is affected and what could happen?
Reports suggest that all PHP versions from PHP 5 onwards may be vulnerable. PHP is one of the most widely used programming languages for web servers, so this could affect a large number of websites and applications. The vulnerabilities could allow attackers to execute code on a server without needing to log in. This is known as unauthenticated remote code execution (RCE). If exploited, attackers could take control of affected servers, potentially stealing data, defacing websites, or using the servers for further attacks.
What do we know about the technical details?
The full technical details of the vulnerabilities have not been made public. One report suggests that CVE-2026-109618 may be a "use-after-free" bug, a type of memory error that can allow code execution. However, the root cause, affected components, and exact attack paths are not yet confirmed. Security firms WatchTowr and Huntress have both stated they have not seen active exploitation so far. WatchTowr's CEO confirmed the vulnerabilities are real but declined to share technical details until patches are released.
What has PHP said and what should defenders do?
PHP has warned that patches for these issues are scheduled for release on Wednesday, 21 October 2026 at 14:00 UTC. They have urged all PHP users to prepare to upgrade as soon as the patches are available. PHP also noted that if technical details or evidence of attacks emerge before the scheduled time, the patches may be released earlier. Sansec, a security firm, has warned that mass exploitation could begin within 15 minutes of the patch release, as attackers often reverse-engineer patches to find and exploit vulnerabilities quickly.
What should website owners and administrators do?
If you run a website or application using PHP, you should prepare to apply the patches as soon as they are released. This may involve scheduling downtime or testing the updates in advance. Consider monitoring your systems for unusual activity, especially after the patch is released. If you use a managed hosting provider, check with them to ensure they are aware of the issue and plan to update PHP promptly.
What is still unclear?
At this stage, there is no confirmation from PHP or a government agency, and only one outlet (SecurityWeek) has reported on the vulnerabilities. The exact technical details, the number of affected systems, and whether any attacks have already occurred remain uncertain. More information is expected once the official patches are released.
Claimed vs confirmed
- Confirmed
Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have been leaked online.
Reported by SecurityWeek, with confirmation from WatchTowr that the vulnerabilities are real.
- Unconfirmed
All PHP versions from 5 onwards are affected.
Reported by SecurityWeek, but not confirmed by PHP or a government agency.
- Unconfirmed
Mass exploitation will likely start within 15 minutes of patch release.
Sansec predicts this, but it has not yet occurred.
- Confirmed
No exploitation in the wild has been seen yet.
WatchTowr and Huntress both report no evidence of active exploitation.
The impact
- Money
- If exploited, organisations could face costs from incident response, downtime, and potential fines. Under UK GDPR, fines can reach up to £17.5 million or 4% of global turnover for serious breaches.
- Reputation
- A successful attack could damage trust in affected websites and services, especially if customer data is stolen or services are disrupted.
- Customers
- Users of affected websites could have their data exposed or services interrupted. Website owners should prepare to patch PHP quickly and monitor for suspicious activity.
Why it matters
PHP runs a large share of the world's websites. If attackers exploit these flaws, they could take over servers, steal data, or disrupt services. Fast patching is critical to protect both businesses and users.
How does it work?
The vulnerabilities could allow unauthenticated remote code execution, meaning attackers could run commands on affected servers without logging in. One flaw may be a use-after-free bug, a type of memory error that can let attackers take control. Full technical details are not yet public.
Key points
- Two critical PHP vulnerabilities have leaked before patches are available.
- The flaws could allow attackers to take over servers without logging in.
- Patches are scheduled for 21 October 2026, but could come sooner.
- All PHP versions from 5 onwards may be affected.
- Mass attacks could begin soon after patches are released.
Sources
SecurityWeek
Reference
