Reported by 4 sources

The short version

  • Two critical vulnerabilities with a 9.2 severity rating have been identified in PHP, affecting versions from PHP 5 onward.
  • Major cybersecurity agencies advise isolating or taking offline systems that cannot be patched immediately due to active exploitation risks.
  • The patches require manual installation by server administrators, as automatic updates are not available for this fix.

Security patches for the PHP programming language, a foundational technology for building websites and web applications, were released on Tuesday to address two critical vulnerabilities. The fixes aim to resolve remote code execution flaws that cybersecurity experts warn could cause widespread disruption across the internet if left unmitigated. According to an advisory published by PHP developers, the vulnerabilities carry a severity rating of 9.2 out of 10, prompting urgent recommendations from global security agencies.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, reportedly impact every version of PHP released since PHP 5. Cybersecurity firm watchTowr described the flaws as Remote Code Execution exploits that allow attackers to run arbitrary code on affected servers. This capability enables malicious actors to alter website content, steal sensitive data, and potentially take full control of server infrastructure. One security researcher estimated that more than 1.3 million internet-connected hosts are likely vulnerable to these attacks.

News Journal

The scope of the threat is particularly significant for platforms built on PHP, including WordPress. Wordfence, a provider of WordPress security plugins, warned that every WordPress site is potentially at risk because they rely on servers running PHP. Given that WordPress powers more than 40 percent of the internet, the potential impact is vast. However, applying the fix presents logistical challenges for many site owners. Wordfence noted that the patch cannot be installed via automatic updates, requiring administrators to manually apply the changes through their hosting providers or server management systems.

In response to the severity of the threat, major cybersecurity organizations have issued strong advisories. The European Union Computer Emergency Response Team and the UK National Cyber Security Centre both encouraged companies unable to patch immediately to isolate their internet-facing applications from public networks or take them offline entirely. Gina Peter Banyard, a PHP developer, emphasized that patching is the only effective mitigation strategy, adding that turning servers off might be the most sensible interim measure for those who cannot apply the fix right away.

Some organizations have already taken preemptive action. GrapheneOS, a mobile operating system developer, temporarily took its user discussion forum offline after learning that proof-of-concept exploits were being developed. The company stated it did not want to take the risk of exposure while waiting for the patch. This cautious approach reflects the high stakes involved, as even brief windows of vulnerability can be exploited by automated attack tools.

Evidence suggests that attackers are already attempting to exploit these flaws before the patches are widely deployed. Dane Knecht, chief technology officer at Cloudflare, reported seeing early attacks emerging against PHP sites hosted on the platform’s network. In response, Cloudflare has temporarily updated its firewall rules as a stopgap measure to block malicious traffic until users can apply the official fix. Threat researchers at Sansec predicted that mass attacks would begin within 15 minutes of the patch release, highlighting the speed at which cybercriminals respond to new vulnerability disclosures.

The PHP development team scheduled the patch release for 10 AM ET on Tuesday but indicated they might release it earlier if details of the vulnerabilities became public or if there was evidence of active exploitation. Users are being urged to upgrade as soon as the release is available. The incident underscores the ongoing challenges in maintaining security for legacy systems and widely adopted technologies, where a single flaw can ripple across millions of dependent services.

As administrators work to apply the patches, the focus remains on minimizing downtime while ensuring security. The lack of automatic update mechanisms for this specific fix means that coordination between website owners and hosting providers is critical. Security experts continue to monitor the situation for signs of widespread exploitation, advising vigilance even after patches are applied to ensure no residual vulnerabilities remain.

The rapid response from both developers and security agencies highlights the collaborative nature of modern cybersecurity defense. While the immediate threat is being addressed through patching, the incident serves as a reminder of the importance of proactive security measures and the need for robust incident response plans in an increasingly interconnected digital landscape.

Sources behind this briefing

Go to the original reporting