Website administrators, prepare to face the unexpected. PHP, the backbone of countless web applications, is set to release emergency patches addressing two severe vulnerabilities. According to the advisory, these patches, with severity ratings of 9.2 out of 10, are due to drop in just over 12 hours.

The maintainers have issued a stark warning, advising all PHP users to prepare for the upgrade, stating, 'All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available.' The advisory notes that the patches may be released earlier if the vulnerabilities become public or evidence of exploitation is found.

The advisory follows the leak of purported details of a tool called PHP2Shell, which demonstrated the execution of code on servers running several popular web applications, including WordPress and MediaWiki. However, the authenticity of the leak remains unconfirmed. Security firm watchTowr claims that the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, affect every PHP version from 2004 onwards.

The maintainers are urging vigilance, stating, 'We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.' This incident serves as a reminder of the ongoing importance of regular security updates in the ever-evolving digital landscape.