PHP Developers Rush Emergency Fixes for Critical Remote Code Execution Flaw

PHP maintainers have announced the imminent release of two emergency patches addressing vulnerabilities rated 9.2 out of 10 in severity. These flaws, tracked as CVE-2026-109618 and CVE-2026-109619, reportedly allow for remote code execution across multiple versions of the PHP language dating back to 2004.

Security researchers have identified an exploit tool, dubbed PHP2Shell, which allegedly targets widely used platforms including WordPress, Drupal, and Laravel. Estimates suggest that approximately 1.3 million internet-connected hosts are potentially exposed to these vulnerabilities.

Organizations are advised to prepare for immediate deployment upon the release of the patches. Security experts anticipate that active exploitation attempts may commence shortly after the vulnerability details become public, necessitating rapid patching cycles to mitigate systemic risk to web infrastructure.