6

Article Rewrite:

New PHP Vulnerability: Urgent Patch Release Coming Soon

PHP, the widely-used programming language powering countless websites worldwide, is set to receive a critical fix for a serious vulnerability in just over 12 hours.

According to a recent announcement by PHP maintainer (source: php.net), patches will be released to address two vulnerabilities, both with severity ratings of 9.2 out of 10.

What to Expect with PHP2Shell Vulnerability

All PHP users are strongly advised to prepare for an immediate upgrade to the latest release once it is made available. PHP maintainers stated, “We reserve the right to release early if details of the vulnerability become public, or if evidence of active exploitation emerges.”

In response to leaked unconfirmed reports, major platforms like WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symphony, Drupal, and WHMCS were highlighted as potentially impacted by a new exploit tool known as PHP2Shell. View a demonstration of this tool here.

Despite challenges in verifying these reports, security firm Watchtower confirmed that the vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, affect all PHP versions dating back to PHP 5 (released in 2004).

Source: arstechnica.com