PHP Warns It Plans To Release 2 Emergency Patches Imminently
An anonymous reader quotes a report from Ars Technica: Website admins, brace yourselves. Fixes for what are believed to be uncommonly severe vulnerabilities are scheduled to drop in a little more than 12 hours for PHP, a programming language that powers websites and Web applications everywhere. PHP maintainers said Monday that they planned to release patches for two vulnerabilities, both with…
Website administrators are urged to prepare for imminent emergency patches to two believed severe vulnerabilities in PHP, a programming language that powers countless websites and web applications. PHP maintainers have scheduled the release of patches within 12 hours, warning all users to upgrade as soon as possible. These vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are deemed particularly dangerous with severity ratings of 9.2 out of a maximum of 10.
Initial evidence of active exploitation has been reported, with a video demonstrating an exploit tool called PHP2Shell successfully executing code on various high-profile platforms such as WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symphony, Drupal, and WHMCS. Researchers from separate security firms predict mass attacks could begin within 15 minutes of the patch release and have also advised administrators to prepare now.
Written by urgent.news from Slashdot's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
