Overview
- On Wednesday, October 21, 2026 the PHP project published emergency updates that address two remote‑code‑execution flaws tracked as CVE‑2026‑109618 and CVE‑2026‑109619.
- Germany’s BSI rated the threat at level 3 / Orange and issued urgent guidance that includes installing patches immediately or temporarily taking webservers offline if they cannot be secured quickly.
- Counties, states, universities, hospitals and major public services in Germany and other countries proactively disabled websites while administrators applied and verified the new PHP packages.
- Security firms and hosts reported early scanning and unconfirmed exploitation attempts and warned that the public leak of technical details could allow rapid, possibly AI‑assisted, automated attacks within hours.
- The crisis highlights a structural risk: many sites run older, unsupported PHP releases that may not receive fixes, raising the likelihood of prolonged outages, data breaches, and pressure on hosts to roll out patches fast.