• Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, have been confirmed and rated 9.2 out of 10 for severity, prompting an emergency security release.
  • A leak of technical details forced the PHP security team to move up its patch release by a day, highlighting the challenges of coordinated disclosure.
  • While PHP powers nearly 70% of websites with known server-side languages, the actual number of vulnerable sites remains unclear pending an official affected-version matrix.

Emergency Release Moved Up After Leak

The PHP security team has confirmed two critical vulnerabilities, collectively dubbed “PHP2Shell,” that could allow attackers to execute remote code on affected servers. The flaws are officially rated 9.2 out of 10 under CVSS v4.0, reflecting their severe potential impact. An emergency security release is scheduled for 10 a.m. EDT today, but the official notice available at this cutoff still describes the release as upcoming, making headlines that a patch “was pushed” premature.

The accelerated timetable follows a leak of information on October 20, before the original coordinated disclosure date of Thursday, October 22. “The embargo was set for Thursday, but given the leak, the team decided to move quickly,” said Benjamin Harris, CEO of security firm WatchTowr, which has been monitoring the situation. Harris added that no exploitation had been observed as of October 20, though subsequent reporting describes early attempted attacks. Attempts do not equate to successful compromises, and no confirmed breaches have been reported.

Scope and Attribution Remain Unclear

PHP’s official announcement has not yet published a list of affected versions or technical prerequisites, leaving administrators uncertain about their exposure. The “70%” figure frequently cited in headlines stems from W3Techs data showing PHP is used by approximately 69.7% of websites whose server-side programming language is known. That is a usage statistic, not a verified count of vulnerable sites, and does not prove that 70% of all websites can be compromised.

The claim that the bugs were discovered using AI also remains unverified. Neither PHP’s official announcement, CERT-EU’s advisory, nor contemporaneous reporting corroborates this assertion. The identity of the discoverer and the role of AI are still unresolved, and attempts to reach PHP’s security team for comment were not immediately successful.

Financial and Operational Pressures

PHP is an open-source project, so the relevant financial picture is the maintenance funding of the PHP Foundation, not corporate earnings. In 2025, the foundation reported gross donations of $730,534 and expenses of $784,376, meaning expenses exceeded net receipts. The foundation supports a stable development team and recently added contractor Joe Watkins, according to its latest transparency report. The incident underscores the funding gap between the widespread use of open-source software and the resources devoted to its upkeep.

Operational costs from the vulnerability are already mounting. CERT-EU has issued an advisory urging organizations to inventory PHP applications, patch promptly once fixed versions are available, and consider isolating internet-facing applications if immediate remediation is not feasible. Hosting providers, government services, and e-commerce platforms—many of which rely on PHP-based systems like WordPress and MediaWiki—are bracing for emergency engineering work and compatibility testing.

Regulatory and Industry Context

The European Union’s Cyber Resilience Act, which since September 11, 2026, requires manufacturers of covered products to report actively exploited vulnerabilities, adds a regulatory layer. However, the Act distinguishes open-source software stewards, whose reporting obligations begin December 11, 2027. A critical vulnerability announcement alone does not trigger reporting requirements under the Act.

This is not the first PHP remote-execution scare. CVE-2024-4577, a flaw affecting certain Windows deployments, was added to CISA’s Known Exploited Vulnerabilities Catalog in June 2024. That precedent shows PHP bugs can progress to real-world exploitation, but the configuration-specific scope of that flaw should not be assumed to match the current vulnerabilities.

The compressed response window—with details leaking before an official affected-version list—has amplified pressure on maintainers. “The most authoritative guidance right now is to prepare for rapid updating and, where necessary, temporarily isolate exposed applications,” said a CERT-EU spokesperson, who declined to comment on specific exploitation status.

As the situation develops, the verified story remains narrower than some headlines suggest: two confirmed critical PHP flaws, an accelerated release after a leak, potentially broad exposure, and key technical details still pending. Whether the vulnerabilities lead to mass exploitation or significant economic damage is not yet known.