PHP to Issue Two Critical Emergency Patches Within 12 Hours

PHP maintainers issued an urgent advisory stating that two critical security bugs, each scoring 9.2 on a ten-point scale, will be patched in roughly 12 hours. Site operators are advised to ready their systems for immediate updating, with the possibility of an earlier release if the vulnerabilities are publicly disclosed or evidence of active exploitation emerges. The warning was triggered by a leaked demonstration video of a exploit tool named PHP2Shell, which purportedly runs code on a range of PHP-driven applications such as WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symfony, Drupal, and WHMCS.

Although the video’s authenticity could not be verified, security firm watchTowr asserted that the issues, catalogued as CVE-2026-109618 and CVE-2026-109619, are genuine and impact every PHP version released since 2004. The firm’s confirmation underscores the broad risk to web services worldwide. Administrators are encouraged to monitor official channels for the patch release and apply it promptly to mitigate potential attacks.