PHP developers announce emergency patch for two critical vulnerabilities

The list of affected versions, fixed builds, and technical details will be published along with the patch. If information about the bugs becomes public or signs of their use in attacks appear, the fix may be released earlier. Server administrators are advised to monitor the official PHP website and update as soon as the release is available.

According to Kod.ru, citing Ars Technica, the announcement was preceded by a leak of unconfirmed data: a video appeared on the network in which the PHP2Shell tool allegedly launches arbitrary code on sites with WordPress, MediaWiki, Joomla, Drupal, and other platforms. According to the IB company watchTowr, the vulnerabilities have been assigned identifiers CVE-2026-109618 and CVE-2026-109619, and both allow remote code execution. Information that all versions starting from PHP 5 are under threat has not been officially confirmed; there have been no reports of exploitation as of October 21.

The company Wordfence warned that all WordPress sites will be vulnerable, and the PHP update will have to be installed manually. According to one researcher's estimate, more than 1.3 million internet-connected hosts are likely to be at risk. The EU's cybersecurity service (EU CERT) and the UK's National Cyber Security Centre recommended that companies that cannot update immediately isolate internet-accessible applications from public networks or temporarily disable them. The developer of GrapheneOS temporarily closed his forum for users.