PHP schedules emergency release for two critical remote code execution flaws after early details leak

A leaked post disclosed two critical PHP remote code execution flaws, dubbed PHP2Shell, prompting PHP to schedule an out-of-cycle security release at 14:00 UTC on October 21 for supported branches 8.2 through 8.5. PHP rated both flaws 9.2 and has not described the mechanism, affected versions, or feature requirements, which will come with the release; the leaked identifiers CVE-2026-109618 and CVE-2026-109619 are not confirmed by PHP. watchTowr verified the leak is real and that the flaws allow code execution. No exploitation was reported as of October 21, and end-of-life branches 8.1 and older will receive no fix.

Check

Prepare to apply PHP's out-of-cycle update for branches 8.2 through 8.5 as soon as it ships, and plan migration off end-of-life 8.1 and older.

Affected

Supported PHP branches 8.2 through 8.5 reportedly contain two critical remote code execution flaws, with end-of-life branches 8.1 and older receiving no fix at all.

Fix

Install the PHP security release immediately on all supported branches, upgrade off end-of-life versions, and watch for exploitation once the technical details become public.