Overview
- PHP maintainers released emergency updates on Wednesday to address two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 that were rated 9.2 for unauthenticated remote code execution.
- National cybersecurity agencies including the NSA, FBI, CISA and CERT-EU urged immediate patching and recommended taking internet-facing sites offline if they cannot be updated quickly.
- Cloudflare, Amazon and other providers reported exploit attempts that scaled from thousands to millions of requests after disclosure and have rolled out web application firewall rules and network mitigations.
- The flaws let an attacker cause memory corruption or reuse stale request data so PHP can run attacker code before site code executes, which can expose server files, databases and credentials.
- Researchers at Wiz and Calif used advanced AI tools to find and demonstrate the bugs, which date back years and leave unsupported or embedded PHP instances the hardest to inventory and patch, making vendor backports and coordinated monitoring essential.