PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert

This story is developing and was written before PHP’s scheduled 14:00 UTC release on October 21. Once the release is out, the affected and fixed versions below are confirmed by the official advisory.

PHP will ship an out-of-cycle security release at 14:00 UTC today, October 21, for two critical vulnerabilities that its security team has rated 9.2 on the CVSS v4.0 scale but has not described.

Security researchers at watchTowr say the two flaws allow remote code execution. Only the four supported PHP branches, 8.2 through 8.5, can receive the fix, and no exploitation has been reported so far.

The advance notice followed a leak. On October 20, a post on HN said two PHP remote code execution flaws, rated CVSS 10.0 and affecting versions from PHP 5 onward, would be disclosed on Thursday, October 22. The poster said they had “no evidence beyond ‘source: trust me, bro’”.

watchTowr then posted on X that the leaked information was real, that the two flaws were under embargo, that everyone had been supposed to wait until Thursday, and that it could not share more for now.

PHP published its notice that evening, at 19:33 UTC, with the release set for Wednesday, a day before the date watchTowr gave. The notice says PHP may release earlier “should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.”

The leak carried the flaws’ existence, a score, a date, and two CVE identifiers, not how the flaws work. The CVSS 10.0 figure is the leak’s. PHP’s rating is 9.2 on version 4.0 of the scale.

The identifiers researchers are using, CVE-2026-109618 and CVE-2026-109619, were also listed in the leaked post. PHP’s notice names neither. The claim that every version since PHP 5 is affected is unconfirmed too: watchTowr’s own FAQ on the flaws says that scope “has not been confirmed by an official vendor advisory” and that no configuration or feature requirement has been described.

PHP says “Full details, affected versions, and the fixed versions will be published with the release.” Researchers have started calling the pair php2shell. The name is theirs, not PHP’s.

Whatever the affected range turns out to be, PHP issues fixes only for its four supported branches, and records each branch’s changes in its changelog. Versions 8.2 and 8.3 receive only security fixes, and 8.4 and 8.5 are in active support. Ahead of the release, several trackers, including Alpine Linux’s and security researcher Kevin Beaumont, expect the fixes to ship as PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, the next point release of each branch, though PHP has not confirmed the numbers.

Anything older, including 8.1, 8.0, 7.x, and 5.x, is end of life and gets no PHP fix. If the flaws reach those branches, installations on them will have no vendor patch.

Security company Mallory counted about 884,000 internet-facing hosts whose HTTP banner reported a PHP version of 8.1 or older to the Shodan search engine on October 20, 59% of the roughly 1.5 million hosts that reported any version. The count covers banners, not confirmed affected systems, and a further 740,000 hosts reported PHP without a version.

PHP has published no workaround. Until the release lands, the preparation comes down to six steps, most of them drawn from a rapid-response post from Huntress, with CERT-EU’s isolation advice added.

1. Inventory every PHP install, including PHP bundled in vendor appliances, Windows software, and control panels such as cPanel and Plesk.
2. Be ready to upgrade at 14:00 UTC. Patch internet-facing systems first, and check your Linux distribution and hosting provider for backported packages.
3. On an end-of-life branch, upgrade, take the system off the internet, or put it behind a VPN or a web application firewall until you can.
4. Where patching cannot be done at once, CERT-EU advises that you “consider isolating internet-facing applications from public networks until a fix is available.”
5. Watch what PHP starts. Alert on php-fpm, php-cgi, httpd, or apache2 launching shells, interpreters, or download tools. On Linux servers without endpoint detection, Florian Roth’s process-watcher logs every program a PHP process starts, with its command line. It sees a program only after it has started and, in Roth’s words, “prevents nothing.”
6. If you find something, isolate the server, preserve the web server and PHP logs, and look for web shells, new files in the web root, new cron jobs, scheduled tasks, and accounts.