PHP Vulnerability Rated 9.2, Highest Severity; EU Recommens Shutting Down Sites

Add preferred source4

On Oct. 21, the PHP development team announced it would release fixes for two critical vulnerabilities rated 9.2 under CVSS v4.0. The identifiers are CVE-2026-109618 and CVE-2026-109619. The flaws could allow remote code execution without authentication, and CERT-EU urged organizations unable to apply the patches to consider taking affected sites offline. Australian authorities issued similar guidance. PHP 5 and later may be affected, but fixes are expected to be provided only for the supported branches 8.2 through 8.5. In Japan, service providers have begun emergency maintenance.Key Elements

PHPCERT-EUCVE-2026-109618CVE-2026-109619php2shellHuntressGoDaddyAustralian Cyber Security CentreWordPressDrupalJoomlaMagentoCVSS v4.0watchTowrIPAGMO Flatt Security

The development team behind PHP, a widely used programming language, said on Oct. 21 that it would release fixes for two critical vulnerabilities. The European Union's cybersecurity agency is urging organizations that cannot apply the patches to consider temporarily shutting down affected websites or disconnecting them from external networks. The flaws could allow attackers to execute code remotely without authentication, raising concerns about the impact on internet infrastructure.

In a security advisory, PHP's development team said both vulnerabilities were rated 9.2 out of a maximum 10 under the CVSS v4.0 severity scoring system. The fixes are scheduled for release at 2 p.m. GMT on Oct. 21 (10 a.m. EDT on Oct. 21, Wednesday), and users were urged to "update promptly once the patched versions are released." Details of the affected versions are expected to be disclosed when the patches are published.

The two vulnerabilities have been assigned the identifiers "CVE-2026-109618" and "CVE-2026-109619." However, these numbers, the "PHP 5 and later" scope, and the initial CVSS 10.0 rating all came from researchers when information leaked on Oct. 20; PHP's official advisory disclosed neither the numbers nor the scope. Researchers are calling the pair "php2shell." Security firm watchTowr said the scope of impact "has not been confirmed in an official vendor advisory."

In an advisory dated Oct. 20, the EU Agency for Cybersecurity (CERT-EU) said the 9.2 rating indicates a risk of remote code execution without authentication. It asked organizations to prepare to apply the fixes to affected systems immediately, and said those facing difficulties should consider shutting down affected sites. The Australian Cyber Security Centre (ACSC) issued similar guidance, urging organizations to identify PHP systems in their environments, prepare to apply patches and monitor for suspicious activity. The center said it "has not observed active exploitation of these vulnerabilities at this time."

According to cybersecurity firm Huntress, PHP is widely used for building and managing websites, shared server services and administrative interfaces. It underpins major content management systems such as WordPress, Drupal, Joomla and Magento, and many software products that do not explicitly state they use PHP run it internally, the firm said.

Web hosting giant GoDaddy said the vulnerability could allow attackers to execute code on targeted servers over the internet. It could lead to data theft, website tampering or full system takeover. CERT-EU and ACSC said all versions from PHP 5 onward may be affected, but PHP has not disclosed which versions are vulnerable.

Note: The CVE numbers and the "PHP 5 and later" scope are based on the views of CERT-EU and ACSC. PHP has not disclosed affected versions.

Fixes are expected to be provided only for the four branches PHP supports. According to PHP's official website, the currently supported versions are 8.2, 8.3, 8.4 and 8.5, with support for 8.1 and earlier having ended. Sites running end-of-life versions will not receive fixes from PHP itself, so they need to migrate to newer versions or check whether Linux distributions or rental server operators are providing patched versions.

The impact is spreading in Japan as well. According to ITmedia NEWS, the childcare-center SaaS "Kodomon," the game "Shadowverse: Worlds Beyond" and "Sakura Rental Server" either entered emergency maintenance or announced plans to do so from around 11 p.m. on Oct. 21. The online shop creation service "BASE" and the rental server "X Server" are also expected to take similar steps. Several of these services have been confirmed to be affected by the PHP vulnerability, according to company announcements and reporting by the outlet. The Information-technology Promotion Agency (IPA) also called on Oct. 21 for operators of websites and applications using PHP to inventory their usage and prepare to apply fixes quickly once released.

PHP is widely used as the foundation for major website-building tools such as WordPress. According to W3Techs, which surveys web technology usage, 69.3% of websites whose server-side language is known use PHP. Many sites run on shared servers, and because the existence of the vulnerability was discussed before the fixes were released, the risk of a "patch gap" — attackers analyzing the fixes and creating exploit code immediately after release — is heightened.

GMO Flatt Security said the vulnerability appears to be a memory corruption issue related to PHP's session management function, and that code claiming to exploit it has already begun circulating on the internet. Mitigation through configuration changes is limited, and the only fundamental remedy is applying the patched versions, it said. Web hosting operators and corporate system administrators will be forced to decide immediately after release whether they can apply the patches, and, if not, to take measures to prevent the damage from spreading, including temporarily shutting down sites.