PHP Critical Vulnerabilities Leaked Before Patch

Two critical PHP vulnerabilities leaked before their patch, early attacks are reported, and the EU’s CERT says internet-facing applications may need to be isolated until it is installed. PHP’s security team has scheduled the fix for October 21 at 14:00 UTC (16:00 CEST). Both flaws are rated CVSS v4.0 9.2, and researchers report remote code execution.

What Happened

On October 20, a post on Hacker News claimed that two critical PHP remote code execution flaws were about to be disclosed. The post was taken down, but the security firm watchTowr said the leaked information was real and that the flaws were under embargo until Thursday. PHP’s security team then published an advance notice that evening: a release on Wednesday, October 21 at 14:00 UTC fixes two critical vulnerabilities, both rated CVSS v4.0 9.2, and it may come earlier if details become public or exploitation starts.

The notice does not describe the flaws. PHP says the full details, affected versions and fixed versions will be published with the release. CERT-EU and researchers use the identifiers CVE-2026-109618 and CVE-2026-109619, which PHP’s notice does not name, and the nickname php2shell, which is the researchers’ and not PHP’s. CERT-EU advisory 2026-018 (version 1.0 dated October 21) says no technical details are public, advises organisations to prepare for immediate patching and, where that is not possible, to isolate internet-facing applications from public networks until a fix is available. Exploitation reports conflict. As of October 21, 15:00 CEST, Cloudflare’s CTO said on X, as quoted by Reuters, that his company sees early attacks and has added firewall rules as a stopgap, and Patchstack says multiple active exploitation incidents are confirmed, without publishing details. Australia’s ACSC says it knows of no exploitation, and Huntress had seen none in its partner environments as of October 20. The flaws are not in the CISA KEV catalog, according to watchTowr. No indicators of compromise are public.

Why It Matters

PHP sits underneath WordPress, Drupal, Joomla, Magento, shared hosting, control panels such as cPanel and Plesk, and software that does not advertise that it runs PHP. When the flaw is in PHP itself, the question is not “which of our apps is affected” but “where do we run PHP at all”. CERT-EU and Australia’s ACSC state the flaws could affect every PHP version from PHP 5 onwards, CERT-EU citing a social media post; PHP has not confirmed this, and watchTowr’s own FAQ says the scope is unconfirmed.

The version question matters because PHP maintains only four branches, currently 8.2 to 8.5. PHP 8.1, 8.0, 7.x and 5.x are end of life. PHP has not said which branches the release covers, and researchers expect fixes only for supported ones, so installations on older branches may get no vendor patch.

What You Should Do Now

1. Inventory every PHP install. Start with web servers, then look for PHP bundled in vendor appliances, Windows software and control panels, and for anything running WordPress, Drupal, Joomla or Magento. Write down the PHP version of each.
2. Plan the patch window around the release. Patch internet-facing systems first, take the fixed version numbers from the official PHP announcement, and check your Linux distribution and hosting provider for backported packages.
3. Deal with end-of-life PHP. On PHP 8.1 or older, plan an upgrade and put the system behind a VPN or a web application firewall in the meantime. If you cannot patch at once, follow CERT-EU and isolate the application.
4. Watch what PHP starts. Alert when php-fpm, php-cgi, httpd or apache2 launch shells, interpreters or download tools. If you find something, isolate the server, keep the web server and PHP logs, and look for web shells, new files in the web root, new cron jobs and accounts.

DIESEC Perspective

A leak before the patch gives attackers a head start on the one group that cannot patch yet, and Cloudflare and Patchstack say attacks have started, so the first step is knowing what you run, not waiting for the fix.

Not sure where PHP runs in your environment? Contact DIESEC for a rapid exposure inventory and a web shell hunt across your internet-facing systems.

Sources: PHP Foundation notice | CERT-EU 2026-018 | Huntress | The Hacker News
Published: 2026-10-21 | Category: Vulnerabilities & Patches | ~4 min read