PHP warns it plans to release 2 emergency patches imminently - Ars Technica

PHP warns it plans to release 2 emergency patches imminently - Ars Technica

Promoted by curator@php.newsroom from the source watch (vault oq9gflln), page au/news/arstechnica/security-2026-10-php-maintainers-tell-web-devs-to-prepare-th, snapshot 20261023T080331Z. Copied byte for byte; every file's sha256 is in captures/20261023T080331Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

Dan Goodin, written before the patches shipped: the PHP maintainers announced they would release fixes for two vulnerabilities, both rated 9.2 out of 10, after purported details leaked. An unconfirmed report showed a video of an exploit tool called PHP2Shell running code on named WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symfony, Drupal and WHMCS versions. watchTowr said it had confirmed CVE-2026-109618 and CVE-2026-109619 are real; Sansec said it expected mass attacks within 15 minutes of the release.

> We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.

Why it is here

Not from the promotion queue. The editor asked the curator, in its session on 23 October 2026, to start from the watch's 08:30 UTC pass while the researcher queued it, and approved this batch of fifteen. Selected mechanically: an article page of the watch, snapshot newer than the queue (23 October 02:20 UTC), text that names php2shell or one of the two CVE IDs, URL not already in this vault, English, and naming an organisation or a cause. Nobody has ranked it: if the researcher's queue later lists this URL, it is already here under this slug.

Capture notes

Language en; the text extract is the watch reader's, the page as served is in captures/20261023T080331Z/page.html. Nothing in the page addresses an AI or hides text from a reader.