Overview
- Researchers using advanced AI tools discovered two long‑standing PHP vulnerabilities and reported them to the PHP maintainers before an early leak accelerated public disclosure.
- The flaws, tracked as CVE‑2026‑109618 and CVE‑2026‑109619 and rated 9.2 on the CVSS scale, can allow unauthenticated remote code execution and reading of process memory.
- PHP released emergency fixes for supported releases (for example 8.5.12, 8.4.27, 8.3.36 and 8.2.35) and said updating is the only full mitigation while some vendors may backport patches for older versions.
- National cyber agencies and the NSA, FBI and CISA urged immediate patching or temporary takedowns, and infrastructure firms reported exploit scanning that climbed from thousands to millions of attempts after details went public.
- Because PHP powers roughly 70% of identifiable websites and is bundled into many hosting stacks and apps, unpatched or forgotten instances remain the main ongoing risk and could lead to large‑scale compromises if not fixed.