PHP Flaws Leaked Before Patches: What Website Owners Need to Know

Two serious flaws affecting PHP, the programming language behind a large share of the web, were revealed before their planned disclosure. Tracked as CVE-2026-109618 and CVE-2026-109619 and known collectively as 'PHP2Shell', they were due to be disclosed on October 21 at 2pm GMT alongside patches. On October 20, a forum user posted the CVE identifiers, which were meant to stay secret until fixes were available. The post, since deleted, claimed the flaws affected versions back to PHP 5 and could allow remote code execution and server takeover.

PHP is used by about 69.7% of websites whose server-side language is known, according to W3Techs. That includes content management systems such as WordPress, Drupal, Joomla and Magento, as well as e-commerce platforms. The source notes that leaking details like affected versions before a patch exists can help malicious actors exploit a flaw, for example through reverse engineering. Security firm WatchTowr confirmed the two flaws were scheduled for later disclosure.

The PHP security team said in a bulletin that patches were due at 2pm GMT on October 21, not October 22 as the forum user claimed. It also rated the severity at a critical 9.2, rather than the maximum 10.0 suggested in the leak. The team added that it reserves the right to release earlier if details become public or active exploitation appears. Major cybersecurity authorities have urged users to prepare for remediation.