PHP maintainers have announced upcoming security updates for two high-severity vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 in severity.
Research suggests these flaws may impact PHP versions dating back to 2004.
Reports have identified a tool, 'PHP2Shell,' purportedly capable of executing code on widely used platforms including Laravel, Drupal, and Joomla.
Developers and sysadmins should prepare for an immediate update rollout.
Because PHP is used to power a huge number of websites and applications on the internet, the development team asks administrators to prepare to immediately install updates as soon as they become available.
Why is there concern?
The warning came after reports emerged of a tool called “PHP2Shell.” According to this information, the tool appears to be able to allow third parties to take control of systems running popular platforms, including WordPress, Joomla, Drupal, Magento, Laravel, MediaWiki, phpBB, Symphony, and WHMCS.
Although the exact details of how the tool works have not been fully confirmed, cybersecurity firm watchTowr has confirmed that the security vulnerabilities it relies on exist.
READ ALSO
Firefox: New security update protects against fake websites
The PHP team has stated that it may expedite the release of fixes if more technical details are publicly leaked or if it is found that someone is already actively using these vulnerabilities for attacks.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)