Two critical PHP vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 have been exposed ahead of PHP’s scheduled security release, prompting warnings that vulnerable servers may face rapid exploitation once technical details and patches become available.
SecurityWeek reports that PHP rated both flaws CVSS 9.2 and planned to publish fixes at 14:00 UTC on October 21. The vulnerabilities could enable unauthenticated remote code execution, although the available public details did not identify the affected component, root cause or attack path. PHP urged users to prepare to upgrade as soon as the release is available.
Sansec says the vulnerabilities affect web servers running PHP 5.4 or later, including deployments involving Magento, Shopware and WooCommerce stores. Its report says a screenshot of an exploit tool called PHP2Shell leaked alongside the advisory, but the tool’s claimed version coverage and the broader impact remain based on leaked information and researcher assessment rather than a published PHP technical advisory.
WatchTowr told SecurityWeek it believed it had successfully reproduced CVE-2026-109618 while withholding technical details. SecurityWeek also reports that WatchTowr and Huntress had not observed exploitation in the wild. Sansec expects mass attacks to begin within 15 minutes of the patch release, a forecast rather than evidence that exploitation has started.
Defenders should prepare to apply PHP’s fixed versions when they are published. The fetched reports do not yet establish the final affected components, fixed-version list or whether exploitation has begun.