'We expect mass attacks to start within 15 minutes of the release': Web admins braced for emergency PHP updates to plug leaked high-severity holes

The PHP security team has given advanced notice of an upcoming fix for two critical security vulnerabilities, both rated at 9.2 out of 10 on the CVE severity scale.

Info about the flaws seems to have leaked ahead of their official disclosure, as a video is being shared which reportedly shows a tool called PHP2Shell being used to remotely execute code on webservers via the vulnerabilities (via Ars Technica).

The PHP programming language is widely used across the internet and powers a huge number of websites. The fix is due to be released at 2pm UTC (10 am ET). Researchers from cybersecurity firm Sansec say the vulnerabilities affect all web servers running PHP 5.4 or later, and that "we expect mass attacks to start within 15 minutes of the release."

Dane Knecht, the chief technology officer for Cloudflare, says the company is already updating its firewall rules for PHP sites. "We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a stopgap only," Knecht posted on X. "Patch as soon as @ThePHPF releases the update at 14:00 UTC today."

Speaking to Bleeping Computer yesterday, the CEO of cybersecurity firm WatchTowr, Benjamin Harris, said: "In the last hour, two remote code execution vulnerabilities in PHP have been leaked. These vulnerabilities were previously scheduled under embargo and due for release on Thursday at 11 am ET."

"While we are not able to share technical information at this point for obvious reasons, given the sensitivity, we can confirm that these vulnerabilities are indeed real. Both of them are CVSS10 and are understood to affect PHP versions 5, 6, 7, and 8."

It sounds like a pretty anxious time for web administrators around the world right now. The current advice for admins includes taking an inventory of every PHP install, planning a maintenance window to coincide with the update, and making a backup of site and database files in anticipation.

For the rest of us, I guess we're in the hands of the server gods now. 2026 has been a year of increasingly sophisticated security exploits, but this one seems to be on a much larger scale (and of a much higher severity) than most. To quote Samuel L. Jackson in Jurassic Park: Hold on to your butts?