Two previously unknown vulnerabilities in the PHP programming language forced an emergency security release on October 21, 2026, after details leaked online days before researchers and the PHP project were ready to disclose them. The flaws have been nicknamed “PHP2Shell” in public reporting, a name that reflects what they can apparently do: hand an attacker a working shell on a vulnerable server without needing a password.
The two issues, tracked as CVE-2026-109618 and CVE-2026-109619, each carry a CVSS v4.0 score of 9.2, putting them near the top of the severity scale. According to security firm Huntress, the bugs sit inside the PHP interpreter itself rather than in any single application built on top of it. That distinction matters. A flaw in WordPress or Drupal would only threaten sites running that particular software, but a flaw in PHP itself can affect WordPress, Drupal, Joomla, Magento, Laravel and any other PHP-based site running an exposed version of the language, regardless of which content management system or framework sits on top.
Patchstack, a WordPress security vendor, reported that at least some technical details about the vulnerabilities surfaced online before the PHP project’s coordinated disclosure date, which appears to be why exploitation attempts began before a fix existed. By 07:34 UTC on October 21, Patchstack said it had confirmed multiple active exploitation incidents, though it did not disclose how many sites were affected or name any victims. Researchers at WatchTowr and Huntress said separately that they had not yet observed exploitation in the wild as of their own checks, a discrepancy that likely reflects how fast-moving and fragmented early reporting gets around an unpatched, widely-discussed flaw rather than a contradiction either side got wrong.
WatchTowr chief executive Benjamin Harris said his team reproduced CVE-2026-109618 internally and confirmed the vulnerability is genuine, a step researchers often take to verify a bug independently before deciding how much detail to share. WatchTowr said it would hold back its own technical write-up until the PHP project’s patch was available, to avoid giving attackers a head start.
That patch was scheduled for 14:00 UTC on October 21, 2026 (10:00 a.m. Eastern), according to a warning the PHP project issued the day before. The project left open the possibility of shipping fixes earlier if technical details became public or evidence of in-the-wild exploitation emerged, both of which now appear to have happened to some degree. As of publication, the PHP project had not released a list of which specific PHP versions are vulnerable or fixed, saying only that this information would accompany the release. Some public reporting suggests the underlying bug reaches back as far as PHP 5, and one analysis described CVE-2026-109618 as a use-after-free vulnerability, a type of memory-handling bug that can often be turned into remote code execution with enough effort.
Dutch security firm Sansec, which tracks server-side attacks on e-commerce platforms, predicted that mass exploitation would likely begin within 15 minutes of the patch’s release, on the assumption that attackers would quickly reverse-engineer the fix to work out exactly what it closes off. CERT-EU also issued its own warning about the flaws, tracked internally as advisory 2026-018.
For site owners, the practical advice from every firm tracking this story is the same: have a plan ready to update PHP the moment a fixed version is available, rather than waiting to see what happens. Given how broadly PHP underpins the web, hosting platforms and managed WordPress providers are likely to push these patches out to customers automatically, but anyone running a self-managed server should treat this as an update to apply within hours, not days.
Sources: SecurityWeek, Patchstack.
