PHP has announced an emergency security update set for release at 14:00 UTC today, October 21, addressing two critical vulnerabilities rated 9.2 on the CVSS v4.0 scale. This urgent action comes after security researchers from watchTowr identified these vulnerabilities, which could potentially allow remote code execution. The update will be available for PHP branches 8.2 through 8.5, with no current reports of active exploitation.
Background on the Security Alert
The disclosure of these vulnerabilities follows a leak on October 20. A post on HN claimed that two PHP remote code execution flaws, rated CVSS 10.0, would be revealed on October 22. However, this information, lacking concrete evidence, prompted PHP to advance their security release by a day. watchTowr confirmed the existence of these vulnerabilities under embargo and emphasized the importance of withholding details until Thursday.
PHP issued a statement at 19:33 UTC on October 20, detailing their plan to release the fix sooner if any further information became public or if evidence of exploitation emerged. While the leak mentioned two CVE identifiers, CVE-2026-109618 and CVE-2026-109619, PHP has not officially named these in their notice.
Implications for PHP Users
The vulnerabilities, informally named php2shell by researchers, may affect versions from PHP 5 onward, although this has not been confirmed by an official vendor advisory. PHP is committed to providing fixes only for its supported branches: 8.2, 8.3, 8.4, and 8.5. Older versions, including 8.1 and earlier, will not receive patches.
According to security firm Mallory, as of October 20, approximately 884,000 internet-facing hosts are running PHP versions 8.1 or older. This represents 59% of the 1.5 million hosts reporting PHP versions, highlighting the potential scope of systems that could remain vulnerable.
Preparation and Mitigation Steps
Until the update is released, PHP users are advised to take precautionary measures. This includes inventorying all PHP installations, being ready for an immediate upgrade, and prioritizing internet-facing systems. On unsupported versions, consider upgrading, removing systems from the internet, or utilizing a VPN or web application firewall.
CERT-EU suggests isolating vulnerable applications from public networks if immediate patching is not possible. Monitoring PHP processes and alerting on suspicious activity is also recommended, particularly for Linux servers lacking endpoint detection capabilities.
As of October 20, Huntress reported no observed exploitation of these vulnerabilities within its environments and no development of a proof of concept. However, previous incidents indicate that security flaws can be targeted swiftly once made public, underscoring the importance of timely updates and vigilance.
The forthcoming release from PHP is expected to provide comprehensive details on the vulnerabilities, including affected versions and any specific configuration requirements. Users are urged to stay informed and apply the updates as soon as they become available.
