php2shell: Will Two Leaked Bugs Break the Internet?

A "Tell HN" post appeared on Hacker News at 15:20 UTC on Tuesday, Oct. 20, citing a "reliable source" and naming two CVE numbers nobody outside a private embargo should have had. The poster admitted having no evidence for the claim. It did not matter. Within hours screenshots were everywhere, and watchTowr's CEO was on X confirming the bugs were real: "We were all supposed to wait until Thursday at 11am ET."

That is the entire origin story: an unverified tip that happened to match two real CVE numbers.

The verdict: the bugs are real and a fix is coming. Almost everything else circulating about scope and severity is unverified.

PHP's security team responded the same day with an advance notice of an upcoming security release. Two critical vulnerabilities scheduled for Wednesday, Oct. 21 at 14:00 UTC, both rated 9.2 under CVSS v4.0.

What's Locked Down, What Isn't

Two bugs, CVE-2026-109618 and CVE-2026-109619, both 9.2 under PHP's scoring. watchTowr says it reproduced CVE-2026-109618 but is not releasing technical information until patches arrive. Huntress has not seen in-the-wild exploitation as of Tuesday, Oct. 20.

Fixed versions when they land are expected to be 8.5.12, 8.4.27, 8.3.36, and 8.2.35, covering PHP 8.2 through 8.5 only.

PHP has not confirmed which function or extension is broken, whether a default install is exposed, or whether the bugs require unusual configuration. The claim that every release since PHP 5.4 in 2004 is vulnerable traces to the leaked PHP2Shell tool's banner and watchTowr's early posts, not to PHP's advisory. The severity is also disputed: the official rating is CVSS v4.0 9.2, not the 10.0 circulating online.

The leaked PHP2Shell demo reportedly ran code against WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symphony 8.1.9, Drupal 11.4.10, and WHMCS 9.0.9. That's a genuinely frightening reel of logos if the tool works at scale against unmodified installs. Right now, it's a video and a banner claim, not validated by PHP.

Who Doesn't Get a Fix, Regardless

PHP 8.1 and anything older is past its security support window and gets nothing. Researchers estimate roughly 884,000 internet-facing PHP hosts—about 40% of the ~2.23 million identified—are running a version that gets nothing.

PHP runs roughly 7 in 10 websites, WordPress included. If the 9.2 rating holds and default installs really are exposed, this is the infrastructure event of the year. If exploitation needs a specific, uncommon configuration, a thin and unverified tip will have manufactured a week of panicked patch tickets for a bug that barely touches production reality.

You find out which at 14:00 UTC Wednesday, Oct. 21.

What to Watch

Watch whether PHP's advisory names a specific function or extension. Watch whether Laravel, WordPress, and Magento ship emergency releases within hours of 14:00 UTC, which would signal they expect default-install exposure. Watch whether watchTowr's "every version since 2004" line survives contact with PHP's actual changelog, because that number traces back to a tip its own author admitted was unverified.