Overview
- Security teams disclosed two critical PHP vulnerabilities registered as CVE-2026-109618 and CVE-2026-109619 and the PHP project published patched releases on Wednesday.
- Both flaws permit remote code execution, which lets an attacker run arbitrary programs on an affected web server, seize sites, and access or steal backend databases.
- Public bodies, hospitals and universities temporarily took websites offline while administrators installed updates and performed integrity checks, and many sites have been gradually restored after verification.
- Infrastructure firms reported large-scale automated exploitation attempts — Cloudflare said it saw “millions” of probe attempts — and researchers warned that AI can turn published fixes into working exploits very quickly.
- Consumers need no immediate action because the bug sits on servers, but web hosts and site operators must update to supported PHP versions or isolate legacy instances now because cleanup could take weeks to months and unpatched systems risk outages and data breaches.