PHP Ships Emergency Out-of-Cycle Patch Today for Two Critical RCE Flaws After Early Leak (“PHP2Shell”)

Scope: PHP branches 8.2 through 8.5 (older unsupported branches receive no fix)

Severity: Red

PHP’s security team is releasing an out-of-cycle update at 14:00 UTC today, October 21, 2026, for two critical remote code execution vulnerabilities rated 9.2 on CVSS v4.0, tracked as CVE-2026-109618 and CVE-2026-109619. The early release schedule itself tells part of the story: these were originally due for coordinated disclosure tomorrow, October 22, but a post on Hacker News yesterday leaked both the CVE identifiers and a claim that the flaws carry a maximum CVSS 10.0 score and affect every PHP version going back to PHP 5, forcing the security team to move up the timeline. Security researchers at watchTowr confirm the flaws enable remote code execution, and as of today neither Huntress nor watchTowr has observed active exploitation or found working proof-of-concept code, though that window will likely close quickly once today’s patch and the technical details that accompany it become public. PHP underpins a significant share of the web, including WordPress and the enormous ecosystem of business-built custom PHP applications common across Ugandan government and private sector websites, making this one of the broadest-reaching patch events of the month regardless of its final severity once full technical details emerge. Organisations running PHP must apply today’s release as soon as it is available, limited to supported branches 8.2 through 8.5, and should treat any system still running an unsupported PHP branch as needing a migration plan since those will not receive this fix at all.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.