The team behind PHP released emergency security updates on Wednesday to fix two critical vulnerabilities, a day after details about the flaws leaked online.

The UK’s National Cyber Security Centre (NCSC) is urging organizations to install the fix immediately.

PHP is a programming language that runs on web servers. When you load a webpage, PHP often runs behind the scenes, retrieving data from databases and building the page before it reaches your browser. BleepingComputer notes that it powers many websites, including content management systems, online stores, and custom web services. According to the NCSC, PHP is also built into a range of other products.

The NCSC says the two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, could allow an attacker to run their own commands on a PHP-based server without logging in. This is called remote code execution, and it’s one of the most serious kinds of security bugs.

According to the NCSC, an attacker could overload PHP’s memory to corrupt it, then, under certain conditions, use that corruption to take control of the server. One of the flaws involves how PHP processes form submissions and file uploads.

PHP rated each flaw 9.2 out of 10 on CVSS, the industry’s standard severity scale. Security firm watchTowr described them as a perfect 10, BleepingComputer reported, and so did an anonymous Hacker News post that has since been deleted. Researchers have started calling the bugs "PHP2SHELL."

The fixes were originally planned for a coordinated release later this week, so companies would have time to prepare.

Source link