PHP warns of major security flaws, announces emergency release to fix it

PHP, which powers a large portion of the internet, has warned of major security flaws. The PHP security team has announced that it is set to release a security update that will fix these flaws, advising users to update their platforms as soon as it arrives.

The internet may soon witness a spree of cyberattacks. PHP, a programming language that powers a large part of the internet, has two critical vulnerabilities. To address these major flaws, the PHP security team has announced that it is going to release a “critical” security release, urging all website developers to update their platforms as soon as it arrives.

In a post on its website, the PHP team said that it had scheduled the security release for October 21 at 2 pm UTC, or 7:30 pm IST. As per the PHP team, both vulnerabilities are rated 9.2 out of 10 on its CVSS v4.0 scale.

PHP has advised users to install the update as soon as it comes. “All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available,” the post said. The PHP team did not confirm what the flaw was or the affected versions. “We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild,” the team added.

PHP vulnerabilities leaked?

While PHP has not officially mentioned what the flaws are, as per reports, the vulnerabilities may have been leaked online. Information the vulnerabilities was reportedly leaked on 20 October.

Security firms have identified the flaws as remote code execution flaws, tracked as CVE-2026-109618 and CVE-2026-109619. A screenshot and video showed an exploit tool called PHP2Shell, credited to Calif.IO, purportedly running code on servers using platforms including WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symfony, Drupal and WHMCS. The tool's banner claimed it worked against PHP 5.4.0 and later, but the scope remains unconfirmed.

“According to an unverified report, the vulnerability would let an attacker run their own code on a server running PHP, potentially taking control of it,” security firm WatchTowr said.

To put things into perspective, many websites and apps today use PHP, including Wikipedia and those hosted by WordPress. Many enterprise platforms also use PHO. This could lead to a string of cyberattacks online. The flaws may allow hackers to gain remote control of websites or platforms. “We expect mass attacks to start within 15 minutes of the release,” security firm Sansec said.

Another security firm, Wordfence, said the release was relevant to all WordPress site owners because every WordPress site runs on a server with PHP installed.

Though PHP has not mentioned the flaws specifically yet. We can expect to get more details the vulnerabilities and the risks involved when the PHP team releases the update later today.

This update from PHP comes at a time when there are growing concerns over cybersecurity , particularly as AI tools have become more capable in recent months . However, there is no word from PHP whether AI tools have played any role in identifying these two flaws.

The internet may soon witness a spree of cyberattacks. PHP, a programming language that powers a large part of the internet, has two critical vulnerabilities. To address these major flaws, the PHP security team has announced that it is going to release a “critical” security release, urging all website developers to update their platforms as soon as it arrives.

In a post on its website, the PHP team said that it had scheduled the security release for October 21 at 2 pm UTC, or 7:30 pm IST. As per the PHP team, both vulnerabilities are rated 9.2 out of 10 on its CVSS v4.0 scale.

PHP has advised users to install the update as soon as it comes. “All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available,” the post said. The PHP team did not confirm what the flaw was or the affected versions. “We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild,” the team added.

PHP vulnerabilities leaked?

While PHP has not officially mentioned what the flaws are, as per reports, the vulnerabilities may have been leaked online. Information the vulnerabilities was reportedly leaked on 20 October.

Security firms have identified the flaws as remote code execution flaws, tracked as CVE-2026-109618 and CVE-2026-109619. A screenshot and video showed an exploit tool called PHP2Shell, credited to Calif.IO, purportedly running code on servers using platforms including WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symfony, Drupal and WHMCS. The tool's banner claimed it worked against PHP 5.4.0 and later, but the scope remains unconfirmed.

“According to an unverified report, the vulnerability would let an attacker run their own code on a server running PHP, potentially taking control of it,” security firm WatchTowr said.

To put things into perspective, many websites and apps today use PHP, including Wikipedia and those hosted by WordPress. Many enterprise platforms also use PHO. This could lead to a string of cyberattacks online. The flaws may allow hackers to gain remote control of websites or platforms. “We expect mass attacks to start within 15 minutes of the release,” security firm Sansec said.

Another security firm, Wordfence, said the release was relevant to all WordPress site owners because every WordPress site runs on a server with PHP installed.

Though PHP has not mentioned the flaws specifically yet. We can expect to get more details the vulnerabilities and the risks involved when the PHP team releases the update later today.

This update from PHP comes at a time when there are growing concerns over cybersecurity , particularly as AI tools have become more capable in recent months . However, there is no word from PHP whether AI tools have played any role in identifying these two flaws.

The internet may soon witness a spree of cyberattacks. PHP, a programming language that powers a large part of the internet, has two critical vulnerabilities. To address these major flaws, the PHP security team has announced that it is going to release a “critical” security release, urging all website developers to update their platforms as soon as it arrives.

In a post on its website, the PHP team said that it had scheduled the security release for October 21 at 2 pm UTC, or 7:30 pm IST. As per the PHP team, both vulnerabilities are rated 9.2 out of 10 on its CVSS v4.0 scale.

PHP has advised users to install the update as soon as it comes. “All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available,” the post said. The PHP team did not confirm what the flaw was or the affected versions. “We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild,” the team added.

PHP vulnerabilities leaked?

While PHP has not officially mentioned what the flaws are, as per reports, the vulnerabilities may have been leaked online. Information the vulnerabilities was reportedly leaked on 20 October.

Security firms have identified the flaws as remote code execution flaws, tracked as CVE-2026-109618 and CVE-2026-109619. A screenshot and video showed an exploit tool called PHP2Shell, credited to Calif.IO, purportedly running code on servers using platforms including WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symfony, Drupal and WHMCS. The tool's banner claimed it worked against PHP 5.4.0 and later, but the scope remains unconfirmed.

“According to an unverified report, the vulnerability would let an attacker run their own code on a server running PHP, potentially taking control of it,” security firm WatchTowr said.

To put things into perspective, many websites and apps today use PHP, including Wikipedia and those hosted by WordPress. Many enterprise platforms also use PHO. This could lead to a string of cyberattacks online. The flaws may allow hackers to gain remote control of websites or platforms. “We expect mass attacks to start within 15 minutes of the release,” security firm Sansec said.

Another security firm, Wordfence, said the release was relevant to all WordPress site owners because every WordPress site runs on a server with PHP installed.

Though PHP has not mentioned the flaws specifically yet. We can expect to get more details the vulnerabilities and the risks involved when the PHP team releases the update later today.

This update from PHP comes at a time when there are growing concerns over cybersecurity , particularly as AI tools have become more capable in recent months . However, there is no word from PHP whether AI tools have played any role in identifying these two flaws.