Details on two critical-severity PHP vulnerabilities named PHP2Shell have been leaked online ahead of scheduled coordinated disclosure and official patches.
On Tuesday, PHP warned that patches for the critical issues, both with a CVSS score of 9.2, are planned for Wednesday, 21 October 2026 at 14:00 UTC (10:00 am ET), urging defenders to prepare for immediate patching.
“All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available,” PHP said.
It also warned that the fixes may be rolled out earlier, should technical details on the security defects be published or evidence of their in-the-wild exploitation emerges.
The flaws are reportedly tracked as CVE-2026-109618 and CVE-2026-109619 and could lead to remote code execution (RCE). Based on their CVSS score, both could be exploited without authentication, CERT-EU says.
Public reporting calls the vulnerabilities PHP2Shell, suggesting that attackers could exploit them to obtain shells on vulnerable servers.
The publicly available details on CVE-2026-109618 and CVE-2026-109619 do not include a root cause, affected component, or attack path, but one report suggests the former is a use-after-free bug.
Additionally, public reporting suggests all PHP versions from PHP 5 onwards are affected.
Preemptive exposure management firm WatchTowr believes it was able to successfully reproduce CVE-2026-109618, but refrained from sharing additional information until patches are released.
“While we are not able to share technical information at this point for obvious reasons, given the sensitivity, we can confirm that these vulnerabilities are indeed real,” WatchTowr CEO Benjamin Harris said.
WatchTowr and Huntress say they have not seen either of the vulnerabilities being exploited in the wild. According to Sansec, however, mass exploitation will likely start within 15 minutes of the patch release.
UPDATE: PHP has released the patches and cybersecurity firms have started seeing exploitation attempts, including before the fixes landed.
UPDATE 2: Amazon saw exploitation attempts four days before the patches were released. Vendors are checking their products for PHP2Shell, security firms are shipping detections, and governments are urging immediate patching.
Related: Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks
Related: Drupal Warns of Fast Exploitation Risk for Critical Core RCE Flaw
Related: Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure
Related: Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack
