Leaked PHP Flaws PHP2Shell Demand Immediate Pre-Patch Preparation

Details regarding two critical remote code execution flaws in PHP, collectively named PHP2Shell, have been leaked online. The disclosure occurred before the scheduled coordinated release of official patches. According to SecurityWeek, the PHP project warned users to prepare for immediate upgrading. The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, carry CVSS scores of 9.2. The project stated fixes are planned for October 21, 2026, at 14:00 UTC.

Root cause

Public reporting suggests CVE-2026-109618 is a use-after-free bug. However, the leaked details do not include specific information about the affected component or the exact attack path. SecurityWeek reports that root cause information remains sparse. WatchTowr, a preemptive exposure management firm, stated it successfully reproduced CVE-2026-109618. The company confirmed the vulnerabilities are real but withheld technical specifics to avoid aiding attackers before patches are released.

View the original post on X

View the original post on X

Attack path

The flaws could allow unauthenticated remote code execution. CERT-EU notes that the CVSS score indicates exploitation without authentication is possible. Public reports call the vulnerabilities PHP2Shell, implying attackers could use them to obtain command-line shells on vulnerable servers. Despite the severity, WatchTowr and Huntress stated they have not observed either vulnerability being exploited in the wild. Sansec predicts mass exploitation will likely begin within 15 minutes of patch release.

Affected versions

Public reporting indicates that all PHP versions from PHP 5 onwards are affected by these critical flaws. The PHP project has not specified which minor releases are vulnerable or immune. Given the broad version range, defenders should assume their environments are exposed. The project urged all users to prepare now so they can upgrade as soon as the release is available. Early patching may occur if exploitation evidence emerges.

Mitigation

• Prepare systems for immediate patching on October 21, 2026
• Verify patch deployment readiness across all servers running PHP 5 or later
• Monitor for early patch releases if in-the-wild exploitation is detected
• Review server configurations to ensure they can accept updates without downtime

Signals worth monitoring

Security operations teams should watch for unusual outbound connections from web servers. Look for new processes spawned by the web server user that should not exist. Check access logs for requests that trigger errors or unexpected responses. Monitor for file creation in temporary directories. Teams usually deploy network detection rules to catch shell commands. Containment moves include isolating affected hosts. Disable vulnerable services if possible. Check whether any automated scripts are running on the server.

Background: Exposure management

Exposure management maps every asset an attacker can reach. For small teams, start by automating external scans, enforcing least privilege on cloud accounts, and delegating internal patching to managed providers. Focus on reducing attack surface rather than chasing every vulnerability.

Read the full guide: Exposure Management for Small Teams: What to Fix First

What to do and how to stay safe: PHP

• Inventory all servers running PHP and verify their current version numbers
• Test patch deployment procedures in a staging environment before the release date
• Set up alerts for any unexpected process execution on web-facing servers
• Review firewall rules to restrict unnecessary outbound traffic from web servers

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

When will patches for PHP2Shell be released?

Patches are scheduled for October 21, 2026, at 14:00 UTC, but may be released earlier if exploitation is detected.

Are these vulnerabilities being exploited in the wild?

WatchTowr and Huntress stated they have not seen either vulnerability being exploited in the wild as of the report.

Which PHP versions are affected?

Public reporting suggests all PHP versions from PHP 5 onwards are affected by the flaws.