PHP's security team will release emergency fixes at 14:00 UTC on October 21 for the flaws, which are rated 9.2 on the CVSS v4.0 scale. Because the language powers about 75% of the web—including WordPress and Laravel—and affected versions date back to 5.4, experts are urging administrators to disable the vulnerable session handler or take internet facing applications offline. A detection tool called process-watcher has been released to help technicians monitor for suspicious sub process spawns in the interim.
Wednesday, October 21, 2026
Story
Working PHP Exploits Emerge Ahead of Patch for 75% of Web
Cybersecurity8 hours ago
A demo video dubbed "php2shell" has begun circulating after a security analyst announced the successful reproduction of vulnerabilities CVE-2026-109618 and CVE-2026-109619 in live environments. The analyst, using the handle @j4ck3lsyn, reported that the flaws are based on heap use after free primitives found in the session.upload_progress handler of the PHP core engine, which allows remote code execution before any application-level code runs.
Looking for more context or analysis?
Tilt chat provides reliable, tailored insights, alerts, and automations.