Swati KhandelwalOctober 21, 2026Vulnerability/Web Security PHP will submit an out-of-cycle security release at 14:00 UTC today, October 21, for two critical vulnerabilities that its security team rated 9.2 on the CVSS v4.0 scale but did not describe. Security researchers at watchTowr say the two flaws allow remote code execution. Only the four supported PHP branches, 8.2 to 8.5, can receive the fix, and no exploits have been reported so far. The prior notice came after a leak. On October 20, a post on HN said that two PHP remote code execution flaws, rated CVSS 10.0 and affecting versions from PHP 5 onwards, would be revealed on Thursday, October 22. The poster said they “had no evidence beyond ‘source: trust me, bro.'” Then, watchTowr posted on PHP posted its advisory that afternoon, at 19:33 UTC, with the release scheduled for Wednesday, a day before the date given by watchTowr. The advisory says PHP may be released sooner “if the details of any of the vulnerabilities become public or if evidence of active exploitation appears in the wild.” The leak included the existence of the flaws, a score, a date, and two CVE identifiers, not how the flaws work. The CVSS 10.0 figure is that of the leak. PHP’s rating is 9.2 on version 4.0 of the scale. The identifiers used by the researchers, CVE-2026-109618 and CVE-2026-109619, are also listed in the leaked post. The PHP notice doesn’t name either. The claim that all versions since PHP 5 are affected is also unconfirmed: watchTowr’s FAQ about the flaws says that the scope “has not been confirmed by an official vendor advisory” and that no configuration or feature requirements have been described. PHP says “Full details, affected versions and fixed versions will be published with the release.” Researchers have started calling the pair php2shell. The name is theirs, not PHP’s. Whichever range is affected, PHP issues are fixed only for its four supported branches and logs changes for each branch to its changelog. Versions 8.2 and 8.3 only receive security fixes, and 8.4 and 8.5 have active support. Any older version, including 8.1, 8.0, 7.x, and 5.x, expires and does not receive any PHP fixes. If the failures reach those branches, the installations there will not have a vendor patch. PHP Branches that may receive today’s fix Branch Current Version (September 24) PHP Support Status 8.5 8.5.11 Active support until December 31, 2027 8.4 8.4.26 Active support until December 31, 2026 8.3 8.3.35 Security fixes only until December 31, 2027 8.2 8.2.34 Security fixes only through December October 31, 2026 Security firm Mallory counted about 884,000 Internet-connected hosts whose HTTP banner reported a version of PHP 8.1 or earlier to the Shodan search engine on October 20, 59% of the approximately 1.5 million hosts that reported any version. The count covers banners, unconfirmed affected systems, and another 740,000 hosts reported PHP without a version. PHP has not posted any workarounds. Until launch, preparation is reduced to six steps, most of them taken from a quick response post by Huntress, to which is added CERT-EU’s isolation advice. Inventory every PHP installation, including PHP included on vendor devices, Windows software, and control panels such as cPanel and Plesk. Please be prepared to update at 14:00 UTC. Patch Internet-connected systems first and check with your Linux hosting and distribution provider for supported packages. On an end-of-life branch, upgrade, disconnect the system from the Internet, or put it behind a VPN or web application firewall until you can. When patches cannot be applied immediately, CERT-EU recommends “considering isolating Internet-connected applications from public networks until a solution is available.” Look what PHP starts. Alert about the release of php-fpm, php-cgi, httpd or apache2 shells, interpreters or download tools. On Linux servers without endpoint detection, Florian Roth’s process watcher logs every program that starts a PHP process, with its command line. He only watches a show after it has started and, in Roth’s words, “it doesn’t impede anything.” If you find anything, isolate the server, preserve the web server and PHP logs, and look for web shells, new files in the web root, new cron jobs, scheduled tasks, and accounts. Huntress said it had not seen exploitation of the flaws in its partners’ environments as of Oct. 20, had not created or reproduced a proof of concept, and was not aware of public exploit code. The watchTowr FAQ lists the exploit as none reported as of October 21 and the flaws as not included in CISA’s catalog of known exploited vulnerabilities. For comparison, when CVE-2024-4577, a CGI mode PHP flaw on Windows, was made public in June 2024, Akamai saw exploit attempts against its honeypot servers within 24 hours. The statement should clarify what the advisory hides: which versions are affected, what part of PHP is involved, whether an attack requires a particular way of running PHP, a configuration or a login, and how PHP itself describes the flaws. At the time of writing, PHP had not released the fixes.
