An unconfirmed report claims PHP2Shell enables RCE on PHP sites; watchTowr says the exploit allegedly affects all versions since PHP 5, released in 2004

Your web applications may be vulnerable to remote code execution if they run on PHP versions released since 2004.

PHP is preparing to release two emergency security patches with severity ratings of 9.2 out of 10, in response to an unconfirmed report of a remote code execution exploit named PHP2Shell. The exploit reportedly affects all PHP versions since PHP 5, released in 2004. Security firms watchTowr, Sansec, and Webfence have confirmed the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, and warn of imminent mass attacks. PHP maintainers advised all users to prepare for upgrades as soon as the patches are available, noting they may release them earlier if details become public or exploitation is observed. They also recommended immediate preparation steps including inventorying PHP applications, planning maintenance windows, backing up systems, and monitoring for announcements. An estimated 1.3 million Internet-connected hosts may be affected.

The potential widespread impact of the PHP2Shell exploit, affecting potentially millions of web servers, highlights the persistent reliance on older, unpatched software in critical internet infrastructure. The advisory's urgency and the confirmed severity of the vulnerabilities suggest a significant leap in exploit sophistication, capable of compromising foundational web technologies. This event underscores the ongoing challenge for organizations to maintain up-to-date software inventories and apply critical patches rapidly, especially for widely adopted languages like PHP.

The rapid confirmation and warning from multiple security firms, coupled with PHP's advisory about potentially releasing patches early, indicate a high-stakes race against exploitation. This scenario forces system administrators into a reactive posture, prioritizing immediate patching over planned maintenance, and potentially leading to service disruptions. The reliance on unconfirmed reports and videos for initial disclosure also points to evolving methods of vulnerability dissemination within the cybersecurity community, creating a need for enhanced threat intelligence gathering.