PHP, the globally dominant scripting language for web development, has disclosed two critical remote code execution vulnerabilities rated CVSS 9.2 that could enable attackers to take control of websites. With a scheduled patch release imminent, administrators are being urged to prepare for swift upgrades to protect their online services.
- Two critical RCE flaws in PHP core expose sites to full compromise
- Patch release planned for October 21, 2026, with immediate upgrade advised
- Vulnerabilities impact PHP versions 5 to 8, nicknamed 'php2shell'
What happened
PHP, widely used in web application development, announced two critical-level remote code execution vulnerabilities that could allow attackers to take control of affected websites. The disclosed flaws carry a CVSS version 4.0 score of 9.2 and are tracked as CVE-2026-109618 and CVE-2026-109619. The vulnerabilities potentially affect all major PHP releases from version 5 up to the latest PHP 8. The PHP security team initially planned to release an official patch on October 21, 2026 at 14:00 UTC.
However, the embargo on detailed disclosure was broken early by a post on Y Combinator’s Hacker News, which predicted the October 22 announcement and leaked the vulnerability details, including corrected CVSS scores and affected versions. Following this leak, security researchers and key figures in the community confirmed the authenticity of the bugs and pushed PHP to issue an advance advisory and notification to subscribers. The community has informally dubbed the vulnerabilities 'php2shell'. While researchers have verified the exploitability of at least one flaw, no active exploitation has been reported in the wild so far.
Why it matters
The impact of these vulnerabilities is significant due to PHP's extensive use across millions of websites and web applications worldwide, from small business sites to large enterprise platforms. Remote code execution flaws allow attackers to run arbitrary code on a server, potentially leading to website takeovers, data breaches, insertion of malicious redirects, and other cybercrime activities. This represents a serious risk to the integrity, confidentiality, and availability of online services built on PHP technology.
Given the broad version range affected—including legacy and current releases—many organizations face urgent pressure to identify vulnerable environments and prepare for immediate patching once the update is released. The high CVSS scores underscore the critical nature of the flaws and the need for swift action to mitigate exploitation risks. The premature leak also complicates the response, requiring heightened vigilance across the web security ecosystem.
What to watch next
The PHP development team has committed to releasing a security update promptly, with the fixed versions and full technical details expected alongside the patch on October 21, 2026. Web administrators and hosting providers should prioritize readiness and plan to apply the update as soon as it becomes available to close off attack vectors. Monitoring official PHP channels and trusted security sources will be essential.
Security professionals will also be watching closely for any signs of exploitation attempts in operational environments, especially following the public leak. Organizations employing PHP should review their threat detection capabilities and consider additional mitigations such as web application firewalls to reduce exposure during the patching window. The community response will likely evolve rapidly as new information emerges.