Governments and companies around the world are rushing to secure internet systems after the disclosure of two critical vulnerabilities in PHP, one of the fundamental technologies used to operate websites and online services.
The vulnerabilities — CVE-2026-109618 and CVE-2026-109619 — can allow an unauthenticated attacker to execute code remotely on a vulnerable server.
Both received critical severity ratings.
The PHP project says installations serving web requests are potentially affected, including systems using PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.
The PHP team issued emergency security releases on 21 October: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
The project’s warning is unusually direct: there is no complete workaround that replaces installing the security update.
Cloudflare subsequently reported millions of attempts to exploit the vulnerabilities following public disclosure.
Governments and major organisations have taken internet-facing systems offline while administrators patch and inspect servers. Reuters reported disruption or precautionary shutdowns affecting banking, airline, rail, taxation and government services in locations stretching from Tokyo to Helsinki.
CERT-EU has warned European organisations to patch affected assets immediately. Where updates cannot be installed promptly, it recommends isolating vulnerable internet-facing services until systems can be secured.
Public technical information and proof-of-concept exploit material are already circulating, increasing the risk that automated attacks will continue searching the internet for vulnerable servers.
WHAT WE KNOW: The vulnerabilities are real, patched versions are available, exploit attempts are occurring at very large scale, and organisations running affected PHP versions should update immediately.
SOURCES:
