Two Critical PHP RCE Flaws Leaked Ahead of Schedule; Emergency Patch Released Today

PHP's security team issued an emergency security advisory on Oct. 21, announcing an out-of-band security update to be released at 14:00 UTC that day to fix two critical remote code execution (RCE) vulnerabilities rated 9.2 under CVSS v4.0. The release comes a day earlier than the originally scheduled disclosure because details of the flaws leaked before the patch was ready.

The PHP team had originally planned to disclose and fix the vulnerabilities on Thursday, Oct. 22, but on Oct. 20 a "Tell HN" post appeared on Hacker News claiming a reliable source and saying two CVSS 10.0 PHP RCE flaws affecting all versions from PHP 5 onward were to be made public. The poster admitted having no substantive evidence, and the post was subsequently flagged, but screenshots had already spread widely on social platforms.

Security firm watchTowr later confirmed on social media that the leaked information was accurate. The company said all parties had originally coordinated to wait until 11 a.m. EDT on Thursday, but the leak broke the confidentiality arrangement, and it confirmed the two vulnerabilities do exist. watchTowr said it had successfully reproduced the flaw numbered CVE-2026-109618 but would not publish technical details before the official patch is released.

PHP explicitly reserved the right to release early in its advisory: "If details of either vulnerability become public, or evidence of exploitation in the wild emerges, we reserve the right to release early." No signs of exploitation in the wild have been observed so far, and neither vulnerability is listed in the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities catalog.

Notably, the leaked information included the existence of the vulnerabilities, their scores, the date and the two CVE numbers, but not the technical mechanism of the flaws. The CVSS 10.0 score in the leak was the leaker's claim; PHP's official rating is 9.2 under CVSS v4.0. The identifiers CVE-2026-109618 and CVE-2026-109619 used by researchers also come from the leaked post; PHP's advisory does not list either number.

On scope, the leaked information says all versions from PHP 5 onward are affected, but that claim has not been officially confirmed. watchTowr's FAQ states that the scope is "not confirmed by an official vendor advisory" and does not describe any configuration or feature prerequisites. PHP said "full details, affected versions and fixed versions will be released with the update." Researchers have dubbed the pair of flaws "php2shell," a name coined by researchers and not official PHP terminology.

The differences between the leaked content and the official account can be summarized as follows:

Regardless of the final scope, PHP is providing fixes only for four supported branches. Of these, 8.2 and 8.3 receive security fixes only, while 8.4 and 8.5 are in active support. Earlier versions, including 8.1, 8.0, 7.x and 5.x, are all end-of-life (EOL) and will not receive official patches. Security researcher Florian Roth specifically warned that servers still running PHP 5 and PHP 7 will face a situation with no patch available. In practice, the two PHP 8 branches, 8.0 and 8.1, are also no longer supported, so only 8.2 through 8.5 can obtain official fixes.

The dates in the table come from PHP's official supported versions page. Notably, active support for 8.4 also expires on Dec. 31, 2026, after which it will receive security fixes only; security support for 8.2 has only two months left.

Exposure data further highlights the risk. Security firm Mallory estimates that as of Oct. 20, 884,000 internet-visible hosts reported PHP version 8.1 or earlier to the Shodan engine, accounting for 59% of the roughly 1.5 million hosts that reported any PHP version. The estimate is based on HTTP response headers and does not confirm affected systems; another roughly 740,000 hosts reported PHP but did not give a version number. Web technology survey firm W3Techs shows the scale of installed base from another angle: among websites using a known server-side programming language, PHP accounts for 69.3%; and among websites using PHP, 27.0% still run PHP 7 and 7.7% run PHP 5, meaning 34.7% combined fall on end-of-life branches that will not receive official patches. That survey counts websites, while the Shodan data counts hosts, so the two cannot be directly added together.

PHP is currently offering no interim mitigations, and the patch is seen as the only line of defense. Before the patch is released, security organizations recommend administrators take the following preparatory steps:

In Japan, the Information-technology Promotion Agency (IPA) issued a pre-emptive preparation alert on Oct. 21, asking organizations using PHP to apply the update immediately after release; the release time converts to 11 p.m. Japan time on Oct. 21 (10 a.m. EDT on Oct. 21). The agency also noted that the specific affected version range "still cannot be confirmed," and mentioned that in July 2024 it had also issued an alert over actual attacks exploiting the PHP vulnerability CVE-2024-4577.

With the patch not yet released, estimates of the attack timeline are already out. Security firm Sansec said the leaked content also included a screenshot of an exploitation tool called PHP2Shell, which claims to work against all versions after PHP 5.4.0; the company expects large-scale attacks within 15 minutes of the update's release and urged hosting providers and e-commerce platforms to stand by in advance, noting that the flaw lies in PHP itself and must be fixed at the server level, not patched from website code. According to Ars Technica, the leaked content also included a video showing the same tool executing code on sites built with WordPress, Magento, Joomla, Drupal, Laravel and Symfony, though the demonstration is likewise unconfirmed officially.

Security firm Huntress said that as of Oct. 20 it had found no signs of exploitation in its partners' environments, and that it had not built or reproduced proof-of-concept code and was not aware of any public exploit code. watchTowr's FAQ indicates no exploitation had been reported as of Oct. 21. By comparison, after the Windows PHP CGI-mode vulnerability CVE-2024-4577 was disclosed in June 2024, Akamai observed exploitation attempts on its honeypot servers within 24 hours.

The core risk in this incident is the compressed embargo period. The embargo is the coordination window among vendors, distributions, hosting providers and security firms, designed to let patches and advisories be released simultaneously. Once severity and dates leak, those already holding vulnerability intelligence know exactly how much time remains. For the large installed base still running PHP 5 and PHP 7, even a timely patch means prolonged exposure with no official fix.