Emergency Patching Needed: Two Critical PHP RCE Flaws Disclosed

On October 20, 2026, details of two critical remote code execution (RCE) vulnerabilities in PHP—tracked as CVE-2026-109618 and CVE-2026-109619 —leaked online ahead of their coordinated disclosure and before any patches were available, prompting the PHP security team to accelerate an emergency release.

The PHP development team issued an advisory announcing that security updates addressing both flaws would be released on Wednesday, October 21 at 14:00 UTC (10:00 AM Eastern), a day earlier than the originally planned Thursday embargo, and reserved the right to ship even sooner if technical details went public or active exploitation appeared. Both vulnerabilities are rated CVSS v4.0 9.2 by the PHP security team, though watchTowr and a now-deleted Hacker News post described them as CVSS 10.0—a discrepancy worth noting.

The leaks originated from a Hacker News post by user “petecooper” that was quickly taken down but not before screenshots circulated, and security researchers at watchTowr confirmed the vulnerabilities are genuine, stating they had successfully reproduced CVE-2026-109618. watchTowr CEO Benjamin Harris told BleepingComputer that both flaws affect PHP versions 5, 6, 7, and 8, though PHP has not officially confirmed affected or fixed versions, saying full technical details will be published alongside the October 21 release. Reporting suggests only currently supported PHP 8 branches may receive fixes, potentially leaving end-of-life versions such as PHP 5, 7, and 8.0/8.1 without any patch at all.

No technical root cause, exploitation method, or proof-of-concept code has been published, and as of October 20 neither watchTowr nor Huntress had observed in-the-wild exploitation. Researchers have nicknamed the flaws “php2shell,” a name that typically implies an attacker can send a request to a vulnerable server and obtain a shell. Huntress notes that exploitation would likely manifest as PHP worker processes spawning suspicious child processes—shells such as `sh`, `bash`, or `powershell.exe`, interpreters like `python` or `perl`, or download tools like `curl`, `wget`, or `certutil.exe`—and recommends watching for reverse-shell patterns such as `/dev/tcp/`, `fsockopen`, and `mkfifo`, as well as reconnaissance commands like `whoami`, `id`, and `uname -a` running from the web server.

The risk is amplified because PHP underpins a vast surface area: WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels such as cPanel and Plesk, and vendor appliances and Windows software that bundle `php.exe` or `php-cgi.exe`. Huntress advises organizations to **inventory every PHP installation**, including less obvious locations inside vendor software and control panels, and to plan a patch window for the October 21 release, prioritising internet-facing systems. End-of-life PHP environments should be upgraded, removed from the internet, or placed behind a VPN or web application firewall until they can be remediated, and organizations should alert on PHP spawning shells or download tools, using a tool such as Florian Roth’s free `process-watcher` for visibility on Linux servers. Huntress has baselined normal PHP behaviour across its partner fleet and has detections in place for web server processes spawning shells and webshell activity, with Sigma and YARA rules to follow once technical details are available.