PHP2Shell Details Leak Ahead of Planned Patch Release

Details of two critical PHP vulnerabilities known as PHP2Shell have leaked before PHP’s planned coordinated disclosure and patches, raising the risk of rapid attacks against exposed servers. Sansec expects mass exploitation to begin within 15 minutes of the fixes becoming available.

PHP plans to release patches for CVE-2026-109618 and CVE-2026-109619 on Wednesday, Oct. 21, 2026, at 14:00 UTC, or 10 a.m. ET. The release remains scheduled for that time. PHP may publish the fixes earlier if more technical information becomes public or evidence of exploitation appears.

Both vulnerabilities have a CVSS severity score of 9.2. CERT-EU says the score indicates that attackers could exploit them remotely without authentication. Public reporting refers to the flaws as PHP2Shell because successful exploitation could give attackers a shell on a vulnerable server and allow them to run commands remotely.

The leaked information does not identify the affected PHP component, the full attack path or the cause of either vulnerability. One report describes CVE-2026-109618 as a possible use-after-free bug. This type of memory-handling error can cause software to use data after it has been released. Public reports also indicate that PHP versions dating back to PHP 5 may be affected.

PHP urged users to prepare for immediate upgrades before the patches are released. “All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available,” the project wrote.

WatchTowr reported that it had reproduced CVE-2026-109618 but would not publish technical details before the patches become available. WatchTowr CEO Benjamin Harris described the vulnerabilities as real, adding, “We are not able to share technical information at this point for obvious reasons, given the sensitivity.”

WatchTowr and Huntress have not observed exploitation of either vulnerability in the wild. Sansec forecasts that attackers will begin large-scale exploitation shortly after PHP publishes the fixes.

The vulnerabilities affect PHP, an open-source programming language used for server-side applications, websites and online services. Administrators should identify systems running affected PHP versions, apply the official updates when released and check exposed servers for signs of unauthorized access.