In the quiet architecture of the modern web, a fault line has been discovered running through more than two decades of PHP's history — two critical vulnerabilities, scored 9.2 out of 10, now threaten an estimated 1.3 million internet-connected hosts. PHP's maintainers have announced emergency patches arriving within hours, a rare and sobering signal that the infrastructure beneath much of daily digital life is momentarily exposed. The window between remedy and exploitation may be measured not in days, but in minutes, reminding us how fragile the foundations of interconnected systems can be.
PHP emergency patches imminent for critical vulnerabilities affecting millions
Attackers could begin mass campaigns within fifteen minutes of patches arriving.
Mark
So these are real vulnerabilities, or is this still speculation based on a leaked video?
Mimi
The original report showing the PHP2Shell exploit hasn't been confirmed by PHP maintainers themselves yet. But watchTowr, a security firm, has independently verified that the two CVEs—109618 and 109619—are genuine. So the vulnerabilities exist. The question is whether the exploit video accurately demonstrates them.
Luke
Right, and that distinction matters. We know two critical flaws are real. We don't know if the PHP2Shell tool actually works the way the video shows, or if that's hype. The maintainers are treating it seriously enough to warn everyone, but they're also being careful not to confirm details.
Mark
Why would they release patches so fast if they're not even sure the exploit is real?
Mimi
Because the risk is too high to wait. If the exploit is real and details are already circulating, attackers have everything they need. The maintainers are essentially saying: we can't afford to assume this is false. Better to patch fast and be wrong than to wait and be vulnerable.
Luke
And they explicitly said they'll release even earlier if evidence of active exploitation shows up. That's the real tell—they're monitoring for attacks right now.
Mark
1.3 million hosts affected. Is that every PHP installation, or just the ones exposed to the internet?
Mimi
The estimate is for internet-connected hosts specifically. So yes, systems that are actually reachable from outside. That's still a massive number.
Luke
But we should note that's one researcher's estimate, not an official count. We don't have a definitive number of how many systems will actually be compromised if they're not patched. The 1.3 million figure is the upper bound of what could be vulnerable.
Mark
The video shows the exploit working on WordPress, Drupal, Joomla—all the big platforms. Does that mean the vulnerability is in those platforms, or in PHP itself?
Mimi
It's in PHP itself. Those platforms just happen to use PHP. So the flaw exists in the language layer, and any application built on PHP could potentially be exploited through it.
Luke
Though we should be careful here. The video shows the exploit working on specific versions of those platforms. We don't know if every version is vulnerable, or if there are configurations that would prevent the attack. The maintainers haven't released technical details yet.
Mark
What happens in those fifteen minutes between patch release and when Sansec expects attacks to start?
Mimi
That's the nightmare scenario. Attackers will have the patch, reverse-engineer it to understand the vulnerability, and then start scanning for unpatched systems. Fifteen minutes is how long Sansec thinks that process takes at scale.
Luke
That's their prediction based on how these things usually go. But it could be faster or slower depending on the complexity of the vulnerability and how organized the attackers are. The point is: there's almost no time to react after patches drop.
Der Puls
- Two critical PHP vulnerabilities rated 9.2/10 affect every version of the language released since 2004, placing 1.3 million internet-connected hosts in immediate jeopardy.
- An unverified but alarming video circulating online shows the PHP2Shell exploit executing remote code across WordPress, Drupal, Joomla, Laravel, Magento, and other major platforms that collectively underpin vast stretches of the web.
- Security firms are sounding coordinated alarms — Sansec warns that mass attacks could begin within fifteen minutes of patch release, suggesting adversaries are already staged and waiting.
- PHP maintainers have reserved the right to push patches earlier than the scheduled 14:00 UTC window if exploitation begins in the wild, compressing an already razor-thin preparation timeline.
- Administrators are being urged to inventory PHP systems, back up files and databases, schedule maintenance windows, and in some cases take non-critical systems fully offline until patches can be applied.
In the quiet architecture of the modern web, a fault line has been discovered running through more than two decades of PHP's history — two critical vulnerabilities, scored 9.2 out of 10, now threaten an estimated 1.3 million internet-connected hosts. PHP's maintainers have announced emergency patches arriving within hours, a rare and sobering signal that the infrastructure beneath much of daily digital life is momentarily exposed. The window between remedy and exploitation may be measured not in days, but in minutes, reminding us how fragile the foundations of interconnected systems can be.
PHP's maintainers issued an urgent warning: two critical vulnerabilities, each carrying a severity score of 9.2 out of 10, are being disclosed alongside emergency patches set to arrive within twelve hours. Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws reach back to PHP 5's debut in 2004, meaning more than two decades of the language's versions are affected. Security researchers estimate roughly 1.3 million internet-connected hosts are exposed.
The alarm intensified when an unconfirmed video surfaced online showing a tool called PHP2Shell executing remote code against a wide roster of major platforms — WordPress, Drupal, Joomla, Laravel, Magento, MediaWiki, and others. While the original report remains unverified, security firm watchTowr confirmed the underlying vulnerabilities are real. Sansec researchers warned that mass attacks could begin within fifteen minutes of patch release, a timeline so compressed it implies attackers are already preparing. Webfence and Huntress have issued parallel advisories urging immediate action.
The PHP maintainers themselves acknowledged they may release patches ahead of schedule if details leak or active exploitation is detected. For administrators, preparation is both urgent and specific: identify who manages PHP systems, catalog dependent applications, back up files and databases, and monitor PHP.net closely. Some security experts are recommending that non-critical systems be taken offline entirely until patching is complete.
The stakes are amplified by PHP's reach. WordPress alone powers roughly forty percent of all websites, and the language underpins countless content management systems and internal tools worldwide. Legacy deployments running older PHP code are just as vulnerable as modern ones. The gap between patch availability and widespread exploitation may be minutes — and for those who have not yet begun preparing, that window is already narrowing.
The PHP maintainers issued a stark warning Monday: two critical vulnerabilities are coming to light, and patches will arrive within twelve hours. Website administrators across the internet need to act now.
The two flaws carry severity ratings of 9.2 out of 10—the kind of score that means widespread damage is possible if systems remain unpatched. Both vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, affect every version of PHP released since 2004, when PHP 5 first shipped. That spans more than two decades of the language's evolution, and it means the exposure is vast. Security researchers estimate that roughly 1.3 million internet-connected hosts running PHP could be at risk.
The urgency stems from an unconfirmed report that surfaced online, showing a tool called PHP2Shell executing remote code on web servers. The video demonstration depicted the exploit working against a roster of major platforms: WordPress 7.1.3, Drupal 11.4.10, Joomla 6.2.0, Laravel in multiple versions, Magento 2.4.9, MediaWiki 1.46.2, phpBB 3.3.17, Symfony 8.1.9, and WHMCS 9.0.9. All of these systems rely on PHP as their foundation. While the original report has not been independently verified, security firm watchTowr confirmed that the underlying vulnerabilities are genuine.
The implications are severe enough that multiple security firms are sounding alarms. Sansec researchers predicted that mass attacks could begin within fifteen minutes of the patches becoming available—a window so tight it suggests attackers are already preparing their campaigns. Webfence and Huntress have also issued advisories urging administrators to prepare immediately. The PHP maintainers themselves reserved the right to release patches earlier than scheduled if details leak publicly or if active exploitation is detected in the wild.
For website administrators, the clock is ticking. The recommended preparation steps are concrete and demanding. Organizations need to identify who manages PHP systems internally, catalog every application built on the language, schedule a maintenance window beginning at 14:00 UTC with contingency plans for an earlier release, and back up both site files and databases. Monitoring PHP.net for any announcements about accelerated patch timing is essential. Some security experts are recommending that non-critical systems be taken offline entirely until they can be patched, a measure that underscores how serious the threat is perceived to be.
PHP powers a substantial portion of the web's infrastructure. Beyond WordPress, which runs roughly forty percent of all websites, the language underpins numerous content management systems and countless internal tools that organizations depend on daily. A vulnerability affecting all versions since 2004 means that legacy systems running older PHP code are just as exposed as newer deployments. The window between patch release and widespread exploitation could be measured in minutes, not hours. For administrators who have not yet begun their preparations, the time to act is now.
Bemerkenswerte Zitate
All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available. We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.— PHP maintainers advisory
Expect mass attacks to start within 15 minutes of the release.— Sansec security researchers
Möchten Sie die ganze Geschichte?
Das Original lesen bei Ars Technica ↗
General News