Critical PHP Vulnerabilities Leaked Ahead of Patch Release, Prompting Urgent Warnings
Two high-severity PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 (collectively dubbed PHP2Shell), were prematurely disclosed before scheduled patches, triggering alerts from major cybersecurity authorities. The flaws, initially set for coordinated disclosure on October 21 at 2 PM GMT, were exposed a day earlier by a user named petecooper on Hacker News, who revealed the CVE identifiers and claimed both were maximum-severity (CVSS 10.0) remote code execution (RCE) vulnerabilities affecting PHP versions dating back to PHP 5. Exploitation could enable server takeover, posing a significant risk given PHP’s widespread use powering 69.7% of known server-side websites, including platforms like WordPress, Drupal, Joomla, and Magento.
The leak forced the PHP security team to accelerate its response, confirming the vulnerabilities and announcing patches for release at the originally scheduled time. However, the team assigned a CVSS score of 9.2, lower than the leaked claim, and warned it would release fixes early if details became public or exploitation was detected. Cybersecurity agencies, including CERT-EU and the UK’s NCSC, issued advisories urging organizations to prepare for immediate patching. For systems unable to update immediately, CERT-EU recommended isolating internet-facing applications from public networks as a temporary mitigation.
Independent researcher Kevin Beaumont analyzed PHP’s pre-release builds, predicting fixed versions would include 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The PHP team later published an official advisory confirming the vulnerabilities, though the premature disclosure heightened risks of exploitation by malicious actors leveraging reverse engineering. The incident underscores the dangers of early vulnerability leaks, particularly for widely deployed software.
Source: https://www.infosecurity-magazine.com/news/critical-php-vulnerabilities-leaked/
Drupal TPRM report: https://www.rankiteo.com/company/drupal-security-team
Magento TPRM report: https://www.rankiteo.com/company/adobe-commerce
PHP TPRM report: https://www.rankiteo.com/company/phpnet
Joomla TPRM report: https://www.rankiteo.com/company/joomla
"id": "phpadodrujoo1792608275",
"linkid": "phpnet, adobe-commerce, drupal-security-team, joomla",
"type": "Vulnerability",
"date": "10/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': 'Organizations using PHP '
'versions 5 and above',
'industry': 'Technology/Software Development',
'name': 'PHP (The PHP Group)',
'type': 'Software Vendor'},
{'industry': 'Web Development',
'name': 'WordPress',
'type': 'Content Management System (CMS)'},
{'industry': 'Web Development',
'name': 'Drupal',
'type': 'Content Management System (CMS)'},
{'industry': 'Web Development',
'name': 'Joomla',
'type': 'Content Management System (CMS)'},
{'industry': 'E-commerce',
'name': 'Magento',
'type': 'E-commerce Platform'}],
'attack_vector': 'Remote Code Execution (RCE)',
'date_publicly_disclosed': '2026-10-20',
'date_resolved': '2026-10-21T14:00:00Z',
'description': 'Two high-severity PHP vulnerabilities (CVE-2026-109618 and '
'CVE-2026-109619, dubbed PHP2Shell) were prematurely disclosed '
'before scheduled patches, triggering alerts from major '
'cybersecurity authorities. The flaws were exposed by a user '
'on Hacker News, revealing remote code execution (RCE) '
'vulnerabilities affecting PHP versions dating back to PHP 5. '
'The leak forced the PHP security team to accelerate its '
'response, with patches released on the originally scheduled '
'date. Cybersecurity agencies issued advisories urging '
'immediate patching and temporary mitigation measures.',
'impact': {'brand_reputation_impact': 'Potential reputational damage to PHP '
'and affected platforms (WordPress, '
'Drupal, Joomla, Magento)',
'operational_impact': 'Risk of server takeover, potential '
'disruption to PHP-dependent platforms',
'systems_affected': 'PHP-based servers and applications (69.7% of '
'known server-side websites)'},
'investigation_status': 'Ongoing (monitoring for exploitation)',
'lessons_learned': 'Dangers of premature vulnerability disclosure for widely '
'deployed software; importance of coordinated disclosure '
'and temporary mitigation strategies.',
'motivation': 'Premature disclosure (unintentional or malicious)',
'post_incident_analysis': {'corrective_actions': 'Improved coordination '
'between security '
'researchers and vendors; '
'faster patch deployment '
'processes; enhanced '
'temporary mitigation '
'guidance.',
'root_causes': 'Premature disclosure of '
'vulnerability details before patch '
'release; lack of coordination in '
'vulnerability reporting.'},
'recommendations': ['Immediately patch affected PHP versions upon release of '
'fixes',
'Isolate internet-facing PHP applications from public '
'networks as a temporary measure',
'Monitor for exploitation attempts and reverse '
'engineering of patches',
'Enhance coordination between security researchers and '
'software vendors for vulnerability disclosures'],
'references': [{'source': 'Hacker News (petecooper)'},
{'source': 'PHP Security Team Advisory'},
{'source': 'CERT-EU Advisory'},
{'source': 'UK NCSC Advisory'},
{'source': 'Kevin Beaumont (Independent Researcher)'}],
'regulatory_compliance': {'regulatory_notifications': 'Advisories issued by '
'CERT-EU and UK NCSC'},
'response': {'communication_strategy': 'Advisories issued by PHP security '
'team, CERT-EU, and UK NCSC',
'containment_measures': 'Isolating internet-facing applications '
'from public networks (recommended by '
'CERT-EU)',
'incident_response_plan_activated': 'Yes (PHP security team '
'accelerated response)',
'network_segmentation': 'Recommended as temporary mitigation',
'remediation_measures': 'Patching to fixed PHP versions (8.5.12, '
'8.4.27, 8.3.36, 8.2.35)'},
'stakeholder_advisories': 'Advisories issued by PHP security team, CERT-EU, '
'and UK NCSC to affected organizations and '
'developers.',
'threat_actor': 'petecooper (Hacker News user)',
'title': 'Critical PHP Vulnerabilities Leaked Ahead of Patch Release '
'(PHP2Shell)',
'type': 'Vulnerability Disclosure',
'vulnerability_exploited': ['CVE-2026-109618', 'CVE-2026-109619']}