PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws
Details on two critical-severity PHP vulnerabilities named PHP2Shell have been leaked online ahead of scheduled coordinated disclosure and official patches.
On Tuesday, PHP warned that patches for the critical issues, both with a CVSS score of 9.2, are planned for Wednesday, 21 October 2026 at 14:00 UTC (10:00 am ET), urging defenders to prepare for immediate patching.
“All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available,” PHP said.
It also warned that the fixes may be rolled out earlier, should technical details on the security defects be published or evidence of their in-the-wild exploitation emerges.
The flaws are reportedly tracked as CVE-2026-109618 and CVE-2026-109619 and could lead to remote code execution (RCE). Based on their CVSS score, both could be exploited without authentication, CERT-EU says.
Public reportingcalls the vulnerabilities PHP2Shell, suggesting that attackers could exploit them to...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
