PHP maintainers plan imminent patches for CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10. An unconfirmed leak claims the PHP2Shell exploit can remotely execute code and may affect every PHP version from PHP 5 onward.