2 critical security vulnerabilities have been detected in PHP, described as the backbone of the internet. Two more critical security vulnerabilities have been detected in the PHP programming language, which is used on 70 percent of websites, and the PHP development team announced in a statement on October 20 that emergency patches closing the vulnerabilities had been released. The team released the emergency patches.
While the vulnerabilities received a score of 9.2 out of 10 on the CVSS v4.0 system, cybersecurity company watchTowr rated the threat a 10 out of 10. Technical details and the affected version ranges have not yet been fully disclosed. Researchers discovered the vulnerabilities using OpenAI’s GPT-5.6 Sol model; Wiz, which operates under Google, also independently verified the finding with its own artificial intelligence tools.
The vulnerabilities, coded CVE-2026-109618 and CVE-2026-109619, are alleged to allow remote code execution, and it is claimed that code could be executed on the following platforms in a video of the exploit tool named “PHP2Shell”. The alleged platforms are as follows: – WordPress 7.1.3 – MediaWiki 1.46.2 – phpBB 3.3.17 – Magento 2.4.9 – Joomla 6.2.0 – Laravel 13.36.0 – Symfony 8.1.9 – Drupal 11.4.10 – WHMCS 9.0.9
watchTowr announced that it had reproduced at least one of the vulnerabilities in a laboratory environment. Security company Sansec, meanwhile, warned that the first mass wave of attacks could begin within 15 minutes of the patches.
Term: patch
A patch is an update that fixes a bug or a security vulnerability in software.