PHP will ship an out-of-cycle security release at 14:00 UTC today, October 21, for two critical vulnerabilities that its security team has rated 9.2 on the CVSS v4.0 scale but has not described.
The timeline: leak, watchTowr, and PHP’s emergency notice
Events accelerated after an October 20 post on Hacker News asserted that two remote-code-execution flaws — rated CVSS 10.0 in that leak and said to affect versions from PHP 5 onward — would be disclosed on Thursday, October 22. The poster admitted the claim rested on unverified sourcing. watchTowr then posted on X that the information was real, that the issues were under embargo, and that researchers should wait to disclose details. PHP published a short notice that evening, at 19:33 UTC on October 20, setting an earlier release for Wednesday (October 21) and warning it may release sooner if details became public or if evidence of active exploitation appeared.
What PHP has said — and will publish at 14:00 UTC
PHP’s notice did not name the vulnerabilities, affected components, or fixed versions; it said only that full details, affected versions, and fixed versions will be published with the release. The PHP security team assigned the pair a CVSS v4.0 score of 9.2. The project also confirmed it will ship an out-of-cycle release at 14:00 UTC on October 21.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildCVE identifiers, the php2shell label, and version‑support realities
The leaked post included two CVE identifiers — CVE-2026-109618 and CVE-2026-109619 — and the score 10.0; PHP’s public notice named neither CVE. Researchers have begun referring to the pair as “php2shell,” a name the community coined, not one PHP adopted. PHP distributes fixes only for its four supported branches — 8.2 through 8.5 — and records those changes in branch changelogs. Versions older than those four (including 8.1, 8.0, 7.x, and 5.x) are end-of-life and receive no PHP vendor fixes; if the flaws affect those branches, vendors will not issue upstream PHP patches for them.
Measured exposure: Mallory’s Shodan census
Security company Mallory counted roughly 884,000 internet-facing hosts whose HTTP banner reported a PHP version of 8.1 or older to Shodan on October 20 — about 59% of roughly 1.5 million hosts that reported any PHP version. That tally covers banner information, not confirmed vulnerable software, and an additional ~740,000 hosts reported PHP without a version string. In short: a substantial number of internet-facing systems advertise PHP versions that are end-of-life or may not receive vendor patches.
Immediate defensive playbook: guidance from Huntress and CERT‑EU
- Inventory every PHP installation, including PHP bundled inside vendor appliances, Windows software, and control panels such as cPanel and Plesk.
- Be ready to upgrade at 14:00 UTC. Patch internet-facing systems first, and check Linux distributions and hosting providers for backported packages.
- On an end-of-life branch, either upgrade, take the system off the internet, or place it behind a VPN or web application firewall until a fix is installed.
- CERT‑EU advises considering isolation of internet-facing applications from public networks until a fix is available.
- Monitor child processes: alert if php-fpm, php-cgi, httpd, or apache2 begin launching shells, interpreters, or download tools. Florian Roth’s process-watcher was recommended as a lightweight logger of programs a PHP process starts, with the caveat that it records activity only after processes begin.
- If signs of compromise appear, isolate the host, preserve web server and PHP logs, and search for web shells, new files in web roots, new cron jobs or scheduled tasks, and new accounts.
Exploitation status and an operational comparison
As of the dates cited, Huntress reported no exploitation in its partner environments (as of October 20), had not reproduced a proof of concept, and was unaware of public exploit code. watchTowr’s FAQ listed exploitation as “none reported” as of October 21, and the pair of flaws did not appear in CISA’s Known Exploited Vulnerabilities catalog. For historical context, the source notes that when CVE-2024-4577 (a PHP CGI-mode flaw on Windows) was disclosed in June 2024, Akamai observed exploit attempts against honeypots within 24 hours — a reminder that rapid, automated exploitation can follow disclosure.
At the time of writing, PHP had not yet released the fixes; the 14:00 UTC out-of-cycle update should make clear which versions and configurations are affected, whether a particular runtime mode or login is required to exploit the bugs, and the technical nature of the vulnerabilities themselves.
