PHP Prepares Emergency Patches for Critical RCE Flaws After Leak

Emergency PHP Security Patches Scheduled Following Leak of Remote Code Execution Flaws

Website administrators are preparing for emergency security updates scheduled to release to address two uncommonly severe vulnerabilities in PHP, the programming language that powers websites and web applications globally. PHP maintainers announced the upcoming patches following a leak of unconfirmed details regarding two remote code execution flaws, tracked as CVE-2026-109618 and CVE-2026-109619.

Security Firm watchTowr Confirms Real Vulnerabilities

While PHP maintainers initially planned a standard disclosure schedule, security researchers at watchTowr confirmed to BleepingComputer that the vulnerabilities are real and carry critical severity ratings. watchTowr CEO Benjamin Harris stated that the remote code execution flaws were previously scheduled under embargo before information leaked online. The security firm reported that it successfully reproduced CVE-2026-109618 but withheld technical details until official patches become available. The PHP security team advised users to prepare for immediate upgrades, noting they reserve the right to release patches earlier if active exploitation appears in the wild.

Hacker News Leak Triggers Emergency Advisory

The security warning follows a now-deleted post on Y Combinator’s Hacker News forum by a user named “petecooper,” who claimed that two critical PHP remote code execution vulnerabilities carrying CVSS scores of 10.0 would be disclosed. The leaked report included a video of an exploit tool dubbed PHP2Shell executing code on webservers running platforms such as WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symphony 8.1.9, Drupal 11.4.10, and WHMCS 9.0.9. watchTowr indicated that the vulnerabilities affect PHP versions 5, 6, 7, and 8, spanning releases dating back to 2004.

Next Steps for PHP Administrators

The PHP security team intends to publish full technical details, affected version lists, and fixed releases concurrently with the security updates. Researchers have not yet observed active exploitation of CVE-2026-109618 or CVE-2026-109619 in the wild. Administrators are encouraged to monitor official PHP channels and apply the emergency patches immediately upon release.