PHP maintainers have announced two emergency patches for severe vulnerabilities rated 9.2 out of 10. The fixes are expected within 12 hours and affect all PHP versions from PHP 5 onward. Website admins are urged to prepare for immediate upgrades. The advisory follows a leaked video showing the PHP2Shell exploit tool targeting major platforms including WordPress, Drupal, and Magento. Security firm watch Towr confirmed the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, as real. The maintainers warned they may release patches earlier if exploitation details emerge or active attacks are detected in the wild.
The leaked report claimed the exploit works across widely used web applications, including Joomla 6.2.0, Laravel 13.36.0, and WHMCS 9.0.9. While the original source could not be verified, the confirmation from watch Towr has elevated urgency. Organizations running PHP-based systems should assess exposure and patch promptly to prevent potential breaches.
Source: Ars Technica · Summarized by HeadlinesBriefing