PHP2Shell leak prompts imminent 9.2-rated PHP patches, warning of post-fix mass attacks

PHP maintainers have scheduled the release of patches for two vulnerabilities rated 9.2 on the CVSS scale, according to an advisory published on Monday. The update addresses CVE-2026-109618 and CVE-2026-109619, affecting PHP versions from 5 onward.

What happened

The advisory follows the leak of purported details regarding an exploit tool called PHP2Shell, which reportedly enables remote code execution on servers running various PHP-based applications. Although the specific report remains unconfirmed, security firm watchTowr stated it has verified that the vulnerabilities are real.

A video associated with the leak demonstrated the tool executing code on systems running WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symphony 8.1.9, Drupal 11.4.10, and WHMCS 9.0.9. These applications all rely on the PHP scripting language.

PHP maintainers noted they may release the patches earlier than scheduled if details become public or if evidence of active exploitation appears. The advisory urges all users to prepare for the upgrade immediately.

Why it matters

Security researchers from Sansec expect mass attacks to commence within fifteen minutes of the patch release, according to Ars Technica. This rapid timeline underscores the urgency for administrators to have deployment plans ready.

One security researcher estimated that approximately 1.3 million Internet-connected hosts are likely affected by these flaws. Given that PHP powers a vast portion of the web, the potential impact is widespread across both public-facing sites and internal tools.

What to watch

• Monitor the PHP.net homepage for announcements regarding an earlier release time.
• Watch for signs of active exploitation in the wild, which could trigger an emergency patch.
• Observe security advisories from firms like Webfence and Huntress for additional context.
• Track the availability of the PHP2Shell tool and any further leaked details.

Who needs to act first

Teams should prioritize systems with direct Internet exposure, as these face the highest risk of automated scanning and exploitation. Before applying any updates, ensure you have verified backups of both site files and databases to allow for rapid recovery if the patch causes compatibility issues. Test the update in a staging environment first, if possible, to validate application stability. For non-essential systems, consider isolating them from the network until the patch is applied. Coordinate with development teams to ensure all PHP-dependent applications are accounted for in the inventory.

What to do and how to stay safe: PHP

• Identify all internal systems and applications that rely on PHP, including legacy versions from 2004 onward.
• Schedule a maintenance window starting at 14:00 UTC, with contingency plans for an earlier release.
• Back up all site and database files before attempting to upgrade PHP or dependent applications.
• Isolate non-essential systems from the network until they have been patched.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which CVE IDs are associated with these PHP vulnerabilities?

The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619.

Is there a confirmed fix available yet?

No, the patches are scheduled to be released in approximately twelve hours, though maintainers may release them earlier.

Which applications were shown being exploited in the leaked video?

The video showed exploitation on WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symphony 8.1.9, Drupal 11.4.10, and WHMCS 9.0.9.