The team responsible for security in the PHP ecosystem has revealed the existence of two critical vulnerabilities that allow for remote code execution (RCE) and that impact platforms such as WordPress, MediaWiki, or Symphony, among others. This situation has prompted the urgent release of a security patch this Wednesday and has led to numerous websites and web applications being isolated preventively worldwide for security reasons.
PHP is a widely used open-source programming language for the development of web pages and applications, in addition to being used to manage forms, control user sessions, or perform database queries. Therefore, its presence on the internet is massive and constitutes a basic tool for developers on a global scale.
In this context, two remote code execution vulnerabilities have been identified within the PHP ecosystem, cataloged as CVE-2026-109618 and CVE-2026-109619. Both have received a score of 9.2 out of 10 on the CVSS 4.0 scale, placing them at the highest criticality level.
To address these issues, the PHP team has indicated that it will publish a security update this Wednesday, October 21. At the same time, it has asked all PHP users to prepare to apply the patch "as soon as the release is available," as explained in a statement on their official website and in a post on the social network X.
The vulnerabilities have been documented by the cybersecurity firm watchTowr, which has explained that these flaws are known as "PHP2shell" and that they could allow an attacker to execute their own code on the compromised servers, gaining control to maliciously modify websites or steal information.
Researchers have also specified that both flaws affect all branches of the PHP language, from PHP 5 onwards, although no cases of active exploitation of these vulnerabilities have been reported so far.
In practice, the potential scope of these flaws extends to a very wide portion of the web. A clear example is WordPress: all sites that use this platform run on servers with PHP, which represents around 40 percent of internet pages. This has been recalled by the company itself in a note on its blog, where it also points out that it will be the site administrators who must manually update PHP.
In parallel, the European Union Computer Emergency Response Team has issued a notice about these vulnerabilities and about the patch planned to correct them. In that statement, it advises that those entities that cannot apply the update immediately "should consider isolating internet-facing applications from public networks until a solution is available."
The release of the update is scheduled for this Wednesday at 14:00 UTC, which is equivalent to 16:00 in mainland Spain.
Until the patch is available and deployed, numerous services and websites have been proactively isolated on a global scale. In the case of the official WordPress website, at the time of writing this information, a notice is displayed explaining that its services are temporarily not operational while they apply "mitigation measures for the PHP2Shell vulnerability, for which there is still no patch."
On the other hand, Cloudflare's Chief Technology Officer, Dane Knecht, has indicated in a post on X that they have already detected "early attacks" targeting PHP sites using their platform. Therefore, the company is deploying "mitigations as new vectors emerge," awaiting the PHP team to publish the final update.