Teams running PHP-based websites and applications are being told to prepare for a critical security release at 10:00 a.m. EDT on October 21, equivalent to 14:00 UTC. The PHP security team says it will disclose affected and fixed versions with the release, rather than identifying them in advance.
The official notice confirms two vulnerabilities rated CVSS v4.0 9.2. The PHP Foundation repeated the warning on X. At the latest pre-release check, PHP’s website still described the update as forthcoming; existing downloads should not be mistaken for the promised fixes.
The Hacker News reports that researchers call the pair PHP2Shell and associate them with CVE-2026-109618 and CVE-2026-109619. Those identifiers do not appear in PHP’s advance notice. Reports describe remote code execution, meaning an attacker could run code on an affected server, but the public vendor notice does not explain the mechanism.
CERT-EU lists both identifiers in its advisory and says PHP versions from 5 onward could be affected, citing leaked information. That is not confirmation that every version or configuration is vulnerable. The attack prerequisites remain undisclosed, so the alert cannot establish the exposure of an individual installation.
CERT-EU recommends identifying PHP applications and preparing to patch when fixed versions become available. Where immediate remediation is not feasible, it advises considering isolation of internet-facing applications from public networks. Isolation reduces access; it is not a confirmed correction of the underlying defects.
The Hacker News reported no known exploitation at publication. That is a reporting status, not assurance that no attacks have occurred. PHP says public technical details or evidence of active exploitation could prompt an earlier release. A warning of possible code execution should not be conflated with documented exploitation of a different product.
No vendor-confirmed workaround was available in the material reviewed. For end-of-life installations, an affected-version announcement would not restore upstream support. Hosting-provider or distribution packages may have separate maintenance arrangements, which administrators need to check rather than infer from a version banner.
As with other named vulnerability disclosures, the PHP2Shell label is not a substitute for the eventual advisory. The release must establish the affected range, required configuration and exact fixed versions before teams can treat a particular update as remediation.
