Severity Ratings of Vulnerabilities

PHP maintainers announced on Monday their intention to release patches for two vulnerabilities, each carrying a severity rating of 9.2 out of a potential 10. This places them in the category of critical security concerns.

The advisory urged all PHP users to prepare for these updates and to implement them as quickly as possible once they become available. The maintainers emphasized the urgency of the situation, stating: “We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.”

Potential Impact and Exploit Details

The announcement follows the leaking of alleged exploit details, which are yet to be verified. A video surfaced showing an exploit tool named PHP2Shell executing malicious code on various popular platforms that utilize PHP. These platforms include:

• WordPress (version 7.1.3)
• MediaWiki (version 1.46.2)
• phpBB (version 3.3.17)
• Magento (version 2.4.9)
• Joomla (version 6.2.0)
• Laravel (versions 13.36.0 and 8.83.29)
• Symphony (version 8.1.9)
• Drupal (version 11.4.10)
• WHMCS (version 9.0.9)

Although attempts to locate the original report remained unsuccessful, watchTowr, a security firm, indicated that the vulnerabilities affect all PHP versions starting from PHP 5, launched in 2004. They confirmed the existence of these vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619.

Recommendations for Website Administrators

Given the high severity of these vulnerabilities, website administrators are advised to:

• Monitor for updates and patches releasing shortly.
• Prepare to implement the fixes as soon as they are available to minimize potential risks.
• Stay informed about the situation, particularly for any information concerning active exploitation.