PHP warns it plans to release 2 emergency patches imminently
· Technology · Ars Technica, The Hindu
Website administrators have been urged to prepare for the release of emergency patches for two critical vulnerabilities in PHP, the programming language that powers numerous websites and web applications. The vulnerabilities carry severity ratings of 9.2 out of 10 and are tracked as CVE-2026-109618 and CVE-2026-109619. Security firms confirmed that an exploit tool dubbed PHP2Shell demonstrated code execution on webservers running widely used frameworks such as WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symphony, Drupal, and WHMCS. Affected systems reportedly span versions from PHP 5 onward, leading security researchers to warn of potential mass attacks shortly after the patches go live. Maintainers stated they reserve the right to release the fixes earlier if details become public or if active exploitation is detected in the wild.
Why it matters
Millions of websites and internal enterprise tools built on PHP face potential security breaches if administrators fail to apply the upcoming emergency patches immediately.
Read the original report — Ars Technica
Join us on Telegram
Breaking news the moment it lands. At 10,000 members we ship the Android app.