The PHP security team has warned administrators to prepare for emergency updates covering two critical remote code execution flaws, after details of the bugs leaked ahead of a planned embargo. The fixes are scheduled for release on Wednesday at 14:00 UTC, and researchers expect attackers to move within minutes of the patches appearing.
PHP2Shell: Two CVSS 9.2 Flaws Announced Before Any Patch Exists
On Tuesday, the PHP security team told administrators to expect emergency security updates on Wednesday at 14:00 UTC, which is 10:00 AM Eastern and 3 p.m. in the UK. The updates address two remote code execution vulnerabilities, each rated CVSS 9.2 under the CVSS v4.0 scoring system. Public reporting tracks them as CVE-2026-109618 and CVE-2026-109619 and has nicknamed the pair “PHP2Shell.”
PHP powers almost 70 percent of websites whose server-side language is known, according to W3Techs data. The language sits underneath content management and e-commerce platforms including WordPress, Drupal, Joomla and Magento, and reports indicate that all versions from PHP 5 onward may be affected. The installed base and the exact affected branches have not been confirmed.
How the CVE-2026-109618 and CVE-2026-109619 Details Leaked
The vulnerabilities were under embargo, and watchTowr said they were originally due for public release on Thursday. Details leaked roughly an hour before watchTowr contacted a news outlet about them. The PHP team said it reserves the right to release patches early if details become public or if exploitation appears in the wild.
watchTowr CEO Benjamin Harris confirmed that the flaws are real and said the firm reproduced CVE-2026-109618. The company is withholding technical details until patches ship. One report suggests CVE-2026-109618 is a use-after-free bug, but that characterization has not been confirmed by the PHP team.
What Is Known and Unknown About the PHP Remote Code Execution Bugs
Public information does not include a root cause, an affected component or an attack path. CERT-EU said the CVSS vectors imply that no authentication is required to exploit the flaws, which would make them reachable by any remote attacker who can send requests to a vulnerable server.
Severity Discrepancy Between PHP and watchTowr
PHP and public reporting put both flaws at CVSS 9.2. watchTowr, by contrast, described both as CVSS 10. The firm has not published its scoring rationale, and the difference may narrow once technical details are released alongside the patches.
Exploitation Expectations After the Patch Release
watchTowr and Huntress both said they have not seen in-the-wild exploitation so far. Sansec, a firm focused on e-commerce security, expects mass exploitation to begin within about 15 minutes of the patch release. That forecast reflects a common pattern in which attackers compare patched and unpatched code to reconstruct a working exploit as soon as a fix becomes public.
The potential impact is unauthenticated remote code execution on a very large share of the web. Because PHP runs underneath WordPress, Drupal, Joomla and Magento, a flaw in the language runtime would reach site owners who never wrote any PHP themselves and who depend on hosting providers and platform maintainers to apply the fix. PHP, CERT-EU, watchTowr and Sansec are all urging immediate patch readiness, and administrators have been told to inventory their PHP installations and confirm which hosting providers are responsible for them.
CERT-EU Interim Guidance for Servers That Cannot Be Patched Immediately
CERT-EU advised organizations that cannot apply the updates quickly to consider taking vulnerable websites offline. Security researchers also discussed interim mitigations, including disabling PHP’s session.upload_progress feature, though no vendor-confirmed workaround has been published because the affected component remains undisclosed.
Organizations that run PHP directly, or that depend on hosting providers and CMS platforms built on it, face the practical task of inventorying every PHP installation. Shared hosting environments add a layer of dependence on provider patch schedules that site owners cannot control.
The leak also changes the defender timeline. A planned Thursday release turned into a Wednesday scramble, and the PHP team’s statement that it may release early again leaves open the possibility that further schedule changes arrive with little warning. Administrators who wait for technical write-ups before preparing their change windows may find the exploitation window has already opened.
