Two critical PHP flaws, the language behind WordPress, leaked before a patch was ready
The PHP team moved up its patch release after details of two flaws rated 9.2 out of 10 leaked. Here is how to prepare in the meantime, and why older versions are a concern.
Translated from French by AI. The original French article is the reference version.
On October 20, a post on the Hacker News forum announced the upcoming disclosure of two critical vulnerabilities in PHP, the language that powers a large share of the Web, from WordPress to Magento stores. The post disappeared quickly, but screenshots were already circulating. That same evening, the PHP security team changed its schedule.
In an announcement published the same day on php.net, it plans a security update on Wednesday, October 21 at 2:00 p.m. UTC, which is 4:00 p.m. in Paris. It will fix two vulnerabilities rated critical, scored 9.2 out of 10 (CVSS v4). According to watchTowr and CERT-EU, they carry the identifiers CVE-2026-109618 and CVE-2026-109619. PHP has given no technical details and says it reserves the right to publish earlier if the details become public or if exploitation is observed.
An embargo broken ahead of time
Security firm watchTowr confirmed that the flaws are real and says it reproduced the first one. Its CEO, Benjamin Harris, explains that coordinated disclosure had been planned for Thursday, October 22. According to watchTowr, these are remote code execution flaws, meaning an attacker could make the server run their own commands.
Other claims have circulated without being verified. According to Sansec, a screenshot of an attack tool called "PHP2Shell," attributed to Calif.IO, claims to work on all versions since PHP 5.4.0. Huntress reports that a short demo video was posted and then removed. As of October 20, neither watchTowr nor Huntress had observed any real-world attacks.
Older PHP versions may stay unpatched
The affected versions are not officially known: PHP will publish them along with the patch. watchTowr believes PHP 5, 6, 7 and 8 are affected, and CERT-EU writes that the flaws "could" affect all versions since PHP 5. Yet only the 8.2 to 8.5 branches are still maintained. Sansec concludes that servers running 8.1 or older will not receive an official patch, and expects mass attacks within fifteen minutes of publication.
What to do before 4:00 p.m.?
The flaw is in PHP itself, not in your site's code, so it is the server that needs updating. The recommendations from CERT-EU and Huntress overlap:
- Inventory every PHP installation in use, including those built into devices, hosting panels (cPanel, Plesk) or business applications.
- Notify your hosting provider if you do not manage the server, so it applies the update as soon as it is released.
- Handle Internet-facing servers first, and follow the patched packages published by your Linux distribution.
- For outdated versions: migrate or, failing that, take the servers off the Internet or place them behind a VPN. CERT-EU suggests isolating exposed applications if immediate patching is impossible.
- Monitor PHP processes (php-fpm, php-cgi) or Apache processes that launch a shell, curl or wget: this is the typical sign of exploitation.
Drupal and Magento sites are already coming off recent alerts, such as the two critical Drupal flaws or the Magento flaw rated 10 out of 10. This time, the layer underneath is affected. This afternoon, we will still need to read the list of patched versions and the exact nature of the flaws.
Method: AI-assisted monitoring, verified sources, article reviewed and approved by Frédéric LENQUETTE. Our editorial policy.
Share this article
