Major security alert: PHP vulnerable to critical RCE, attacks ongoing

Patchstack says hosting partners have already flagged real-world attacks exploiting two critical flaws in the PHP interpreter itself, tracked as CVE-2026-109618 and CVE-2026-109619, each rated 9.2 (CVSS v4.0) by the PHP security team despite early claims of a 10.0 score. Because the bugs sit in PHP rather than in any single CMS, every site running a vulnerable PHP build is at risk — including WordPress, Drupal, Magento, Joomla and Laravel installs. The issue, dubbed "PHP2Shell" after details leaked ahead of coordinated disclosure, was independently verified and partially reproduced by watchTowr, confirming it enables remote code execution. The PHP team has scheduled an emergency fix for October 21, 2026 at 14:00 UTC, and until then the only recommended stopgap is disabling the default-on session.upload_progress feature via session.upload_progress.enabled = Off, though this does not actually block exploitation — only installing the patched PHP version will.