Overview
- Security teams released fixes after researchers disclosed two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 that carry a 9.2 CVSS v4.0 score and can enable unauthenticated remote code execution.
- The PHP project published emergency updates for supported 8.2+ releases, and it also provided source patches and guidance for vendors to backport fixes for older versions.
- A public leak accelerated disclosure pressure so the PHP fixes were pushed out and, following that, many governments and large sites temporarily took services offline as a precaution.
- Cloudflare and Amazon reported large-scale scanning and exploit attempts, with security firms showing proofs that the bugs can read process memory and expose passwords, tokens, and keys.
- Researchers said advanced AI tools helped find and craft proofs, which sped discovery but also raises concerns that AI could shorten the time from disclosure to mass exploitation and complicate remediation efforts.