The PHP security team announced it would release emergency patches on Wednesday, October 21, 2026, at 14:00 UTC for two vulnerabilities, each rated 9.2 under CVSS v4.0.

The move came after purported details of the flaws, previously under embargo and scheduled for a Thursday disclosure, reportedly leaked ahead of time.

The team said it reserved the right to release earlier if details became public or if evidence of active exploitation appeared, and it urged all PHP users to prepare so they can upgrade as soon as the release is available.

The leak reportedly included a video of an exploit tool dubbed PHP2Shell executing code on webservers running WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0 and 8.83.29, Symphony 8.1.9, Drupal 11.4.10, and WHMCS 9.0.9.

According to BleepingComputer, watchTowr confirmed the two flaws are real remote code execution vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, believed to affect PHP versions 5, 6, 7, and 8 — dating back to PHP 5's 2004 release. watchTowr also said it believes it has successfully reproduced CVE-2026-109618.

The reports differ on some details: the PHP security team assigned each flaw a CVSS v4.0 score of 9.2, while a now-deleted Hacker News post and watchTowr both described CVSS 10.0 ratings.

BleepingComputer reported that watchTowr cited an originally planned Thursday 11am ET disclosure, and said researchers have not observed exploitation in the wild despite the leak.

Ars Technica reports that security firm Sansec expects mass attacks to start within 15 minutes of the release, and that one researcher estimates about 1.3 million internet-connected hosts are likely affected.

PHP is a de facto building block of the web, powering content management systems, e-commerce platforms, and countless internal tools, so unauthenticated remote code execution flaws at this severity could inflict damage across the internet.

Admins are advised to identify who manages PHP in their organization, inventory every PHP-based app, plan a maintenance window starting at 14:00 UTC with contingency plans for an earlier release, back up site and database files, and monitor the php.net homepage for announcements.

Ars Technica reports some experts suggest unplugging non-essential systems until patched. Laravel News said the Laravel team is working with the PHP Foundation to get patched versions into its base images quickly, and users may need to redeploy apps.