PHP ships an emergency security release today, October 21, 2026, at 14:00 UTC. The release fixes two critical bugs in
PHP core: CVE-2026-109618 and CVE-2026-109619. Each one has a CVSS v4.0 score of 9.2. People already call them
"php2shell".
The details leaked on Hacker News one day before the embargo ended. watchTowr confirmed that the bugs are real and
reproduced one of them in their lab. PHP then moved the release one day earlier. Many numbers are going around right
now, and some of them are wrong. The leaked post said CVSS 10.0. The official score is 9.2.
The bigger problem is who gets the fix. PHP supports only 8.2 and later. On Shodan, 59% of internet-facing hosts that
show a PHP version run 8.1 or older. Those servers will not get an official patch. Some Linux distributions backport
fixes, so check your distribution's security tracker before you panic.
If you run PHP, do two things today. Find every installation, including the ones inside containers and appliances.
Then plan the upgrade for anything older than 8.2. After the release, install the update and restart PHP-FPM.
The full post on my blog explains what is confirmed and what is still a rumor. It also has a short checklist and a
detection signal you can use right now.
Originally published on abgeo.dev.
