Ethical Hacking News
PHP website owners and administrators are on high alert as two severe vulnerabilities, with a severity rating of 9.2 out of 10, are set to be addressed with emergency patches. With an estimated 1.3 million Internet-connected hosts likely affected, website owners are urged to prepare now to protect their websites and applications from potential exploitation.
PHP is set to receive two emergency patches to address severe vulnerabilities. The vulnerabilities have a severity rating of 9.2 out of 10 and have already been confirmed by security firms. Users are advised to prepare now and upgrade as soon as the release is available. Experts recommend taking immediate action to protect websites and applications from potential exploitation. 1.3 million Internet-connected hosts are likely affected, and website administrators must remain vigilant.
The PHP programming language, a cornerstone of website development and a de facto building block for the web, is set to receive two emergency patches in the near future. The patches aim to address two severe vulnerabilities, both with a severity rating of 9.2 out of 10, which have the potential to inflict major damage across the Internet.
According to recent reports, the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are real and have already been confirmed by security firms. The PHP maintainers have warned that the patches can be released at any moment, and users are advised to prepare now.
The unconfirmed report, which has yet to be verified, claims that the vulnerabilities allow for remote execution of code on PHP sites. A video depicting the PHP2Shell exploit tool has been shared, which appears to demonstrate the ability to execute code on various web applications, including WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symphony, and Drupal.
Security experts are urging website administrators to take immediate action to prepare for the release of the patches. This includes identifying the responsible party for managing PHP within an organization, taking an inventory of all PHP-based applications, planning a maintenance window, making a backup of site and database files, and monitoring the PHP.net homepage for any late-breaking announcements.
Some experts recommend unplugging non-essential systems until the patches are applied to prevent potential exploitation. With an estimated 1.3 million Internet-connected hosts likely affected, the stakes are high, and website administrators must remain vigilant until the patches are released.
The PHP maintainers have published an advisory, which advises users to prepare now and upgrade as soon as the release is available. The advisory states that all PHP users are encouraged to prepare for the patches, which can be released at any moment.
As the Internet prepares for the release of these emergency patches, website administrators must take immediate action to protect their websites and applications from potential exploitation. With the potential for major damage, it is essential that users take proactive steps to prepare for the release of these critical updates.
Related Information:
https://www.ethicalhackingnews.com/articles/PHP-Warning-Emergency-Patches-on-the-Horizon-for-Vulnerable-Websites-ehn.shtml
https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches/
Published: Tue Oct 20 23:28:51 2026 by llama3.2 3B Q4_K_M
