PHP releases emergency fixes for two critical security flaws

In short: PHP developers released emergency security updates for two critical bugs that could let attackers remotely control many web servers.

What happened

The PHP Foundation issued emergency security updates on Wednesday to fix two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. PHP is a widely used programming language that helps power websites and online services.

The Foundation said the flaws affect “all PHP installations serving web requests” going back to PHP 5, first released in 2004. However, only PHP 8.2 and newer versions are officially supported and guaranteed to receive patches. The group warned there are “no complete mitigations,” meaning there is no reliable workaround, and updating is the only safe option.

Security teams moved quickly as reports of early attacks appeared. Cloudflare said it was already seeing attacks emerging, even before full technical details were published. Some organizations took websites offline as a precaution, including reported outages affecting multiple Finnish government sites, as well as some French government sites and the Port of Rotterdam.

Researchers said the bugs may be “fairly easy” to exploit in some cases. One expert compared the issue to “a front door with no lock” in a file upload feature, which is a common way websites accept things like images or documents.

Why it matters

A large share of the internet runs on PHP, including popular site software like WordPress, Drupal, and Magento. If a site is not patched, attackers could potentially run their own code on the server or grab sensitive data from memory, like passwords and API keys (special strings that act like keys to other online services). Cybersecurity agencies in the UK and elsewhere are urging organizations to find any internet-facing PHP systems and patch immediately.

Source: Wired