Meet someone near you.
Live video chat with people nearby. One tap, free to start.
Two newly disclosed bugs in PHP triggered emergency patches this week. PHP is the programming language that still runs a majority of the world’s websites. A researcher’s early leak forced the PHP security team to move its planned fix forward by a full day. The PHP2Shell critical vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. They let an attacker run their own code on a vulnerable server with no login required. Cloudflare says real-world attacks began within a day of disclosure.
What the PHP2Shell critical vulnerabilities actually do
Security firm watchTowr confirmed both flaws are genuine. It did this by reproducing CVE-2026-109618 in its own lab. The firm is withholding technical detail until site owners have had time to patch. PHP’s advisory rates each bug at 9.2 out of 10 under the CVSS v4.0 scoring system. watchTowr and an early, since-deleted post on Hacker News rated them a full 10 out of 10. Researchers do not fully agree on severity. Everyone agrees the bugs allow remote code execution without authentication, which is the most dangerous category a web vulnerability can fall into.
That matters because PHP sits underneath content management systems, e-commerce platforms, and custom business applications across a huge share of the internet. A successful exploit can let an outsider plant malware. It can also let them steal a database or take over a server outright. Smaller sites running outdated or unmanaged PHP installs face the highest risk, since larger platforms often patch faster.
A leak forced the patch timeline forward
PHP’s security team originally planned to disclose the flaws and release a fix on a Thursday morning. That plan fell apart fast. According to watchTowr, a Hacker News user going by “petecooper” posted the CVE numbers publicly before the coordinated release. PHP published its advisory on October 20, 2026. It pushed out emergency patches the next day, October 21, at 14:00 UTC, rather than wait for the original schedule.
That compressed timeline is part of why the bugs are dangerous right now. Attackers had the CVE numbers before most site operators had a patch to apply. A coordinated disclosure is designed to close that exact gap. This time, the gap opened early instead.
Cloudflare is already seeing exploitation attempts
Within a day of the advisory, Cloudflare told customers it was observing active attack traffic targeting the flaw. The company rolled out web application firewall rules to catch it. Cloudflare describes the protection as temporary, not a substitute for patching. Singapore’s Cyber Security Agency issued its own alert urging administrators to update immediately. Outlets including BleepingComputer have been tracking the advisory as it developed.
PHP core developer Gina Peter Banyard has been direct about the available options. There is no verified workaround. Some researchers have floated disabling PHP’s session upload progress feature. Others suggested blocking multipart/form-data requests at the web server level. Banyard has said the only real fix is applying the official patch. Blocking multipart requests outright will break ordinary file uploads and web forms for legitimate users too, so it is not a safe substitute.
What website operators should do now
Anyone running a self-hosted PHP application should act now. That includes WordPress, Drupal, and custom-built sites. First, confirm your hosting provider or server has applied PHP’s October 21 patch. Managed hosts typically roll this out automatically. Sites on dedicated or self-managed servers need an administrator to update PHP directly. Singapore’s Cyber Security Agency advisory recommends checking server logs for unusual POST requests to upload endpoints, since that pattern can signal an attempted exploit.
Sites that cannot patch immediately should at least ask their host whether its firewall has been updated to match Cloudflare’s temporary rules. An unpatched server with no protection at all is the highest-risk setup right now. Businesses that outsource hosting should not assume their provider has already handled this. A short email asking directly is worth the five minutes it takes.
Website owners outside the direct hosting chain still carry some risk. Plugin and theme developers for platforms like WordPress often bundle their own PHP code. That code can introduce separate vulnerabilities even after the core patch lands. A full security review after patching, not just confirming the update installed, is the more complete response.
Why this keeps happening to widely used software
PHP has existed since the mid-1990s, and much of the web’s infrastructure was built on top of it long before today’s security practices existed. That long history is part of the problem. watchTowr believes the flawed code has likely existed since PHP 5, meaning it survived multiple major rewrites of the language without being caught. Older code paths that handle file uploads and session data tend to get less scrutiny than newer features, simply because fewer people are actively working on them.
Security teams at hosting companies now face a familiar scramble. They must patch servers fast without breaking live sites. A rushed patch can cause its own problems if it is not tested properly first. Most hosting providers run PHP in a shared environment, where a single oversight can affect many customer sites at once. That shared-infrastructure risk is part of why Cloudflare moved so quickly with its own firewall rules. The rules bought extra time for providers that could not patch every server instantly.
What happens next for PHP site operators
Expect PHP’s security team to publish more technical detail once patch adoption climbs. That detail will likely make the flaw easier to exploit for anyone who still has not updated. watchTowr has said it will hold back its proof-of-concept write-up for the same reason. The practical lesson for administrators is simple. The gap between disclosure and patching is now the most dangerous window in any vulnerability’s life, and this time that window opened a day early because of the leak.
For more on how major technology firms are handling security and capacity pressure this year, see Tamara News’ coverage of Google Cloud’s new AI chip instances and Nvidia’s rapid AI factory rollout.
Verification your users actually receive.
Send one-time passcodes over WhatsApp with a single API call. Replio can generate, hash and verify the code for you.
