Executive Summary
On October 20, 2026, the PHP team announced an upcoming security release for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (dubbed PHP2Shell). Preliminary reports from watchTowr describe them as remote code execution vulnerabilities that may affect multiple PHP generations. Some information about the vulnerabilities was disclosed in a forum before the originally planned publication date. However, the technical details, affected versions, and remediation guidance remain unconfirmed pending PHP's official advisory, scheduled for release this Wednesday, October 21, 2026, at 14:00 UTC.
PHP rates both vulnerabilities a CVSS v4.0 score of 9.2 and recommends that users apply the updates as soon as they are released this afternoon. Since the leak occurred, several security researchers claimed to have privately reproduced the bug based on available information. One Proof of Concept (PoC) shared publicly appears related to a flaw in PHP Zend Memory Manager, but seems not to be fully working, while other working PoCs started circulating privately.
As these vulnerabilities impact PHP core and hence plenty of underlying products, we classify the threat level of this advisory as 5 out of 5.