Two critical security vulnerabilities have been detected in PHP, one of the cornerstones of the internet. Emergency patches are being prepared for these vulnerabilities, which are stated to allow remote code execution on servers.
Security vulnerabilities emerging in software used in the internet's infrastructure can have consequences far beyond a single website. Especially vulnerabilities affecting technologies used by millions of websites can turn into a widespread security problem if they allow attackers to gain access to servers. Now, a critical security alert has been issued for PHP, one of the most widely used programming languages on the internet.
The PHP development team is preparing an emergency update for two serious security vulnerabilities. Security researchers state that the vulnerabilities could allow remote code execution, and system administrators are urged to complete their preparations before the patches are released. Claims that the technical details of the vulnerabilities were leaked before the planned disclosure date are also increasing concerns.
Two Critical Security Vulnerabilities Detected in PHP
The PHP security team announced in a statement released on October 20th that updates to address two security vulnerabilities are planned for release on Wednesday, October 21, 2026, at 14:00 UTC (17:00 Turkish time). Both vulnerabilities received a score of 9.2 out of 10 in the CVSS v4.0 security assessment system.
Developers have not yet disclosed the technical details of the vulnerabilities or which PHP versions are affected. The scope of affected versions and fixes is expected to be announced when the updates are released.
The PHP team stated that they might release the patches earlier than the planned date if details of the vulnerabilities are leaked to the public or if evidence of active exploitation emerges. Therefore, administrators are urged to follow announcements and be ready to install updates as soon as possible.
PHP2Shell Claims Raise Concerns
According to security researchers, the vulnerabilities tracked with IDs CVE-2026-109618 and CVE-2026-109619 are alleged to allow Remote Code Execution (RCE) attacks. Such vulnerabilities can enable attackers to execute commands or code remotely on the target system.
Security firm watchTowr reported that it has confirmed the existence of these vulnerabilities and successfully reproduced at least one of them. According to the company's statements, the vulnerabilities are believed to affect PHP versions 5, 6, 7, and 8. However, this information has not yet been confirmed by the PHP team.
A video allegedly demonstrating an exploit tool called PHP2Shell also contributed to these claims. The video purportedly shows code execution on servers running various PHP-based web applications. Examples include WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0 and 8.83.29, Symfony 8.1.9, Drupal 11.4.10, and WHMCS 9.0.9.
Security Firms Issue Attack Warning
Technical information regarding the PHP vulnerabilities is reported to have been leaked before the initially planned disclosure date. watchTowr, in a statement released after the details of the vulnerabilities became public, confirmed their authenticity but stated that it would not share technical details until the patches are released.
The company also stated that it has not yet found any evidence of the vulnerabilities being actively exploited in attacks. Therefore, there is no confirmed information regarding the commencement of attacks at this stage.
On the other hand, security firm Sansec predicts that widespread attacks could begin within 15 minutes of the patches being released. Webfence and Huntress have also warned system administrators to prepare.
There is also a significant scoring difference between the statements of security researchers and the official announcement from the PHP team. watchTowr claims the vulnerabilities are rated 10 out of 10 on the CVSS scale, while the PHP team's official assessment gives both vulnerabilities a score of 9.2.
Millions of Internet Servers Could Be Affected
Although the PHP team has not yet shared details, security experts recommend that organizations complete their preparations before the update. This primarily involves identifying teams responsible for PHP infrastructure within organizations and inventorying all applications developed with PHP. Some security experts also suggest disconnecting non-essential systems from the network until patches are installed. This approach can help reduce risk, especially for servers hosting critical workloads and accessible externally.
Furthermore, PHP is an open-source programming language used to develop dynamic websites and web applications. It is widely used in content management systems like WordPress, as well as in e-commerce platforms, corporate applications, and custom-developed web services. One security researcher claimed that approximately 1.3 million internet-connected servers could be affected by these vulnerabilities.
0 Comments: