PHP2Shell: Critical Flaws Disclosed, Mass Exploitation Feared
Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been leaked ahead of official patches, raising alarms for potential widespread exploitation.
Details surrounding two critical-severity vulnerabilities in the PHP programming language, collectively dubbed PHP2Shell, have surfaced online prematurely. The disclosure comes just ahead of scheduled coordinated release of patches and official advisories, heightening concerns about immediate and widespread exploitation.
PHP issued a warning on Tuesday, indicating that fixes for these critical flaws, both carrying a CVSS score of 9.2, were planned for release on Wednesday, October 21, 2026. The organization urged defenders to prepare for immediate patching upon availability. "All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available," PHP stated, emphasizing the urgency.
The advisory also noted that the release of fixes might be accelerated if technical details of the vulnerabilities were published or if evidence of in-the-wild exploitation emerged. This preemptive warning underscores the severity and potential impact of the disclosed security defects.
The vulnerabilities are reportedly tracked under the identifiers CVE-2026-109618 and CVE-2026-109619. Both are capable of enabling remote code execution (RCE) and, based on their high CVSS scores, can be exploited by unauthenticated attackers, according to CERT-EU. The moniker PHP2Shell suggests that successful exploitation could grant attackers command-line access, or "shells," on vulnerable servers.
While specific root causes, affected components, and attack vectors for CVE-2026-109618 and CVE-2026-109619 have not been fully detailed in public reports, one suggestion points to CVE-2026-109618 being a use-after-free bug. Furthermore, initial reports indicate that all versions of PHP from version 5 onwards are potentially affected, presenting a vast attack surface.
Security firms have begun to assess the vulnerabilities. WatchTowr, a preemptive exposure management company, has stated that it was able to reproduce CVE-2026-109618 but is withholding further technical details until official patches are released. "While we are not able to share technical information at this point for obvious reasons, given the sensitivity, we can confirm that these vulnerabilities are indeed real," said Benjamin Harris, CEO of WatchTowr.
Despite assurances from firms like WatchTowr and Huntress that they have not yet observed these vulnerabilities being exploited in the wild, the threat landscape remains tense. Sansec, a security firm specializing in e-commerce threats, predicts that mass exploitation could commence within minutes of the patch release, mirroring rapid exploitation patterns seen with previous high-profile vulnerabilities.
Given the widespread use of PHP across web applications and servers globally, the potential for mass exploitation of PHP2Shell is a significant concern. Organizations relying on PHP are strongly advised to monitor for the official patch release and apply it immediately to safeguard their systems against potential compromise.