Website administrators are preparing for the imminent release of emergency patches addressing two vulnerabilities in PHP, the open-source scripting language that underpins millions of websites and web applications.

The PHP development team announced on Monday that patches for two vulnerabilities, each rated 9.2 out of 10 on the severity scale, will be made available within approximately 12 hours. The advisory urged all users to ready their systems for immediate upgrade upon release, noting that patches could be issued earlier if vulnerability details become public or if active exploitation is detected in the wild.

The announcement followed the leak of purported exploit details, which remain unverified. A video circulating online demonstrated a tool called PHP2Shell executing code on servers running multiple content management and e-commerce platforms, including WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symfony 8.1.9, Drupal 11.4.10, and WHMCS 9.0.9. The video has been reposted in various security forums.

Efforts to verify the leaked report have so far been unsuccessful. However, security firm watchTowr stated that it had confirmed the existence of the vulnerabilities, which are cataloged as CVE-2026-109618 and CVE-2026-109619. The firm also asserted that the flaws affect every PHP version released since PHP 5, introduced in 2004.

PHP powers an estimated 77% of all websites that use a server-side programming language, according to historical usage statistics. The upcoming patches represent a rare instance of emergency action by the PHP development community, which typically follows a regular release cycle.

The situation underscores the ongoing challenges of maintaining web infrastructure security, particularly as critical vulnerabilities in widely adopted platforms can have broad implications for online services.