PHP warns it plans to release 2 emergency patches imminently

PHP's core team announced it will release fixes within about 12 hours for two vulnerabilities rated 9.2 out of 10 in severity, tracked as CVE-2026-109618 and CVE-2026-109619. The advisory urges all PHP users to get ready to upgrade immediately once the update lands, warning it may ship even sooner if exploitation details leak publicly or active attacks are spotted. The warning followed an unconfirmed leaked report showing a tool called PHP2Shell running remote code against servers hosting WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symphony 8.1.9, Drupal 11.4.10, and WHMCS 9.0.9, all built on PHP. Security firm watchTowr says it has independently verified the two bugs are genuine and claims they impact every PHP release going back to PHP 5 from 2004, making the upcoming patches critical for virtually any PHP-based website.