PHP prepares emergency release for two critical RCE vulnerabilities

PHP has scheduled an out-of-cycle security release for 14:00 UTC on October 21 to address two critical vulnerabilities rated 9.2 under CVSS v4.0. Security researchers at watchTowr say the flaws allow remote code execution, while PHP had not disclosed their technical details, affected versions or fixed releases at the time of the notice.

The fixes can be issued only for the four supported PHP branches: 8.2, 8.3, 8.4 and 8.5. PHP said full details, the affected version range and the fixed versions would accompany the release. No active exploitation had been reported when the article was published.

Leak brought the release forward

The emergency notice followed information posted on Hacker News on October 20. That post claimed that two PHP remote-code-execution issues would be disclosed on October 22, assigned them a CVSS 10.0 score and named CVE-2026-109618 and CVE-2026-109619. Its author acknowledged having no evidence beyond an unnamed source.

watchTowr subsequently said that the leaked information was real and that the vulnerabilities were under embargo, but it did not provide technical detail. PHP's own advisory neither named the CVEs nor adopted the 10.0 score. Its official severity rating is 9.2, and the reported claim that PHP versions from PHP 5 onward are affected remains unconfirmed.

Researchers have begun calling the pair “php2shell”, but PHP has not used that name. The vendor also said it could release fixes earlier if vulnerability details became public or evidence of exploitation emerged.

Supported branches determine patch availability

PHP 8.5 and 8.4 are in active support, while PHP 8.3 and 8.2 receive security fixes only. The current releases listed in the report were 8.5.11, 8.4.26, 8.3.35 and 8.2.34. Older branches, including PHP 8.1, 8.0, 7.x and 5.x, are end of life and will not receive PHP vendor patches.

Mallory counted roughly 884,000 internet-facing hosts reporting PHP 8.1 or an earlier version in HTTP banners on Shodan on October 20. That was 59% of about 1.5 million hosts reporting any PHP version. The figures reflect exposed banners rather than confirmed vulnerable installations, and another 740,000 hosts reported PHP without disclosing a version.

Preparation before technical details arrive

PHP published no workaround. Huntress recommended building a complete inventory of PHP installations, including instances embedded in vendor appliances, Windows applications and control panels such as cPanel and Plesk. Organisations should be ready to upgrade when packages become available, prioritising internet-facing systems and checking Linux distributions and hosting providers for backported packages.

For systems on end-of-life branches, the available options are an upgrade, removal from the internet or temporary protection behind a VPN or web application firewall. CERT-EU also advises considering isolation of internet-facing applications from public networks until a fix is available.

Teams can additionally watch for php-fpm, php-cgi, httpd or apache2 spawning shells, interpreters or download utilities. If suspicious activity is found, isolate the server, preserve web and PHP logs, and inspect for web shells, new web-root files, cron jobs, scheduled tasks and accounts. The practical implication is to identify unsupported PHP now and make internet-facing upgrades the first task once PHP publishes the fixes.