PHP 9.2-Severity Vulnerabilities: Security Patches Expected Within Hours

Website owners should prepare to update. PHP, the programming language that powers websites and web applications worldwide, is expected to receive patches for two extremely serious vulnerabilities within just over 12 hours.

PHP maintainers said Monday that they plan to release fixes for both vulnerabilities, each of which has a severity rating of 9.2 out of 10.

PHP2Shell exploit details remain unconfirmed

“We encourage all PHP users to prepare now to upgrade to a release as soon as it becomes available,” the advisory states. “We reserve the right to release early if details of the vulnerability become public, or if evidence of active exploitation emerges.”

The maintainers issued the advisory after unconfirmed details were leaked. A video reportedly shows an exploit tool called PHP2Shell executing code on a web server running Drupal. The video has been reposted here.

The report references PHP-powered platforms and applications including WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symfony 8.1.9, Drupal 11.4.10, and WHMCS 9.0.9.

Attempts to locate the unconfirmed reports have been unsuccessful. However, security firm watchTowr said the vulnerabilities affect all PHP versions since PHP 5, which was released in 2004.

watchTowr also said it confirmed that the vulnerabilities are real. They are tracked as CVE-2026-109618 and CVE-2026-109619.

What PHP users should do now

PHP users and website administrators should monitor the official PHP advisory and be ready to install the security updates as soon as they are released.