PHP is scheduled to release emergency security patches at 14:00 UTC on 21 October 2026 to address two critical vulnerabilities in PHP, reported to enable remote code execution. Multiple outlets describe the issue as “PHP2Shell,” with security identifiers reported in coverage as CVE-2026-109618 and CVE-2026-109619, and both bugs rated 9.2 (Critical) under CVSS v4.0.
The reports note that details of the vulnerabilities are limited prior to release, with some outlets saying the PHP project plans to publish affected version information and patched version numbers when the fix goes out. Help Net Security and LWN urge administrators to prepare to upgrade immediately, while The Hacker News adds that only supported PHP branches (8.2 through 8.5) can receive the fix and says no exploitation has been reported.
Several outlets mention that vulnerability information may have leaked ahead of disclosure. Ars Technica frames its item around an “unconfirmed report” of remote code execution on PHP sites, while SecurityWeek specifically warns that mass exploitation could become possible if the leaked flaws are acted on. India Today gives a short, general account of PHP warning about major flaws and announcing an emergency release.
