Overview
- Security researchers and the PHP project identified two critical flaws, CVE-2026-109618 and CVE-2026-109619, that allow remote code execution and full takeover of affected web servers.
- Details about the bugs leaked before a planned fix, and the Bundesamt für Sicherheit in der Informationstechnik issued a Warnstufe 3 (Orange) alert that led many German states, municipalities, universities and hospitals to take sites offline as a precaution.
- The PHP maintainers published emergency updates Wednesday afternoon, and many operators have since restored services after patching while others remain offline pending checks and remediation.
- Security firms and hosts reported early scanning or exploit attempts, and agencies including the BSI, NSA and FBI warn that leaked details combined with AI‑assisted tooling increase the chance of rapid, automated attacks.
- Operators are urged to install the issued patches immediately or disconnect exposed servers until fixed because older, unsupported PHP versions complicate cleanup and unpatched sites can cause service outages or data breaches for users.