PHP maintainers warn of critical security patches amid exploit reports

Key facts

• Two critical PHP vulnerabilities, rated 9.2/10, are scheduled for patches within 12 hours.
• Exploit tool PHP2Shell reportedly executes code on PHP-powered websites.
• Vulnerabilities CVE-2026-109618 and CVE-2026-109619 are confirmed real by Sansec.
• An estimated 1.3 million internet-connected hosts may be affected.

PHP maintainers have alerted web developers to prepare for critical security patches addressing two vulnerabilities, each rated 9.2 out of 10, expected within 12 hours. The advisory stated that patches could be released earlier if details become public or exploitation is observed. This warning follows unconfirmed reports of an exploit tool named PHP2Shell capable of remotely executing code on websites running PHP, including platforms like WordPress and Magento. Security firms watchTowr and Sansec have confirmed the existence of the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, and anticipate widespread attacks shortly after the patches are deployed. An estimated 1.3 million internet-connected hosts may be impacted.