The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could allow attackers to execute malicious code remotely without authentication. The PHP security team released patches on Wednesday, October 21, at 13:40 UTC, ahead of its revised 14:00 UTC deadline.
Both vulnerabilities carry severity ratings of 9.2 under the Common Vulnerability Scoring System version 4.0, placing them in the critical category. The defects affect PHP installations supporting websites, online services, content management systems and other applications.
The security team issued corrected versions PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, urging administrators to upgrade immediately. The vulnerabilities collectively became known as PHP2Shell following their premature exposure.
The disclosure controversy began on October 20 when an unidentified individual using the name petecooper published information on the Hacker News discussion platform. The subsequently deleted post identified both vulnerabilities and claimed they would be disclosed on October 22.
The post described the flaws as carrying maximum severity scores of 10.0 and potentially affecting PHP versions dating back to version 5. Those assessments differed from the official ratings subsequently issued by PHP developers.
Cybersecurity company watchTowr confirmed that the vulnerabilities were genuine and had been subject to coordinated disclosure restrictions. Its researchers also indicated that they had reproduced one of the flaws, although they withheld technical exploitation details while developers prepared fixes.
The premature disclosure disrupted the established timetable for releasing vulnerability information alongside protective software updates. Such coordination normally gives developers, infrastructure providers and security vendors time to prepare defences before attackers obtain sufficient information to exploit weaknesses.
The PHP security team responded by announcing an accelerated release schedule and warning that patches could appear earlier if further technical details became public or evidence of exploitation emerged.
The European Union Agency for Cybersecurity, ENISA, subsequently joined the European Commission, CERT-EU, Europol and national cybersecurity response teams in calling for immediate protective action.
Their joint statement warned that unauthenticated attackers could exploit the vulnerabilities to execute malicious instructions on exposed servers. Organisations were advised to identify affected installations, coordinate with hosting providers and prioritise systems accessible through the internet.
Britain’s National Cyber Security Centre issued similar guidance, recommending immediate upgrades and additional monitoring for suspicious activity. It advised organisations unable to implement adequate protections to consider taking vulnerable systems offline.
The urgency reflects the possibility that successful exploitation could compromise server operations, expose sensitive information or provide attackers with access to applications and databases.
Technical assessments identified memory management weaknesses involving error handling and request processing within the PHP runtime. Crafted requests could potentially trigger unintended behaviour before ordinary application security controls were executed.
The PHP developers identified Apache installations using mod_php as particularly exposed, citing a demonstrated attack that could be triggered before application code began running. Other potentially affected configurations include PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.
Google Cloud and Wiz researchers disclosed their involvement in identifying the vulnerabilities and supporting remediation. Google Cloud said its own infrastructure was not vulnerable, while warning that customers operating PHP applications on its services might still require updates.
OpenAI separately disclosed that its security research initiative had identified a critical PHP flaw and contributed to coordinated remediation alongside maintainers and other technology companies.
WordPress also urged website operators to update their underlying PHP installations. It clarified that the vulnerabilities were not specific to WordPress and that no WordPress software update was required to address the underlying defects.
The distinction matters because updating a content management system does not automatically replace the PHP runtime installed on its hosting server. Website administrators may therefore need assistance from hosting companies or infrastructure managers.
WordPress advised administrators to check their installed PHP version through the Site Health interface or their hosting control panel. It also warned that PHP versions older than 8.2 no longer receive security updates from the project.
Singapore’s Cyber Security Agency and Australia’s cybersecurity authorities issued alerts directing organisations to identify affected assets and prepare protective measures.
CERT-EU advised operators unable to patch immediately to consider isolating internet-facing applications until the necessary corrections could be deployed safely.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
