PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws

Two unpatched PHP vulnerabilities dubbed PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, have had their details surface online before PHP's planned coordinated fix. Both bugs carry a CVSS score of 9.2, reportedly allow unauthenticated remote code execution, and are said to impact every PHP release starting from PHP 5. PHP's official patch is scheduled for Wednesday, October 21, 2026 at 14:00 UTC, though the team may push it out sooner if exploit code appears or active attacks are detected. Researchers at WatchTowr say they reproduced CVE-2026-109618 and confirmed the flaw is genuine, while WatchTowr and Huntress report no in-the-wild exploitation yet—though Sansec warns that mass attacks could begin within roughly 15 minutes of the patch dropping, making urgent, same-day updating essential for all PHP deployments.