PHP maintainers scheduled emergency fixes for two vulnerabilities rated 9.2/10 (CVE-2026-109618 and CVE-2026-109619), urging all users to prepare immediate upgrades.
Leaked exploit tooling dubbed PHP2Shell reportedly demonstrated remote code execution across CMS stacks using PHP. watchTowr, Sansec, Webfence, and Huntress warned of mass attacks within minutes of patch release. An estimated 1.3 million internet-facing hosts may be affected.
TechCrunch and NSA guidance noted the flaws existed since PHP 5 (2004) and were found via OpenAI’s “Patch the Planet” work (GPT-5.6 Sol via Calif) and Google’s Wiz Atlas agent before in-the-wild exploitation. AI lowers the bar to adapt exploits across PHP versions and configurations.
Maintainers may release earlier if details leak; source fixes landed in php-src at 13:34 UTC with packages rolling out. Recommendation: upgrade to supported PHP (8.5.12 current); sites that cannot patch immediately should consider going offline per NSA. WordPress requires server-level PHP updates, not a CMS-only fix.