‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire

Key Points:

• The PHP Foundation released emergency security updates addressing two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting all PHP versions since 5.0, with patches officially available only for PHP 8.2 and newer.
• These flaws could allow unauthenticated attackers to execute code remotely or access sensitive server memory, posing a severe risk to millions of websites and applications built on PHP, including major platforms like WordPress, Drupal, and Magento.
• Security experts warn of rapid exploitation, with early attacks already detected and mass attacks expected to begin shortly after patch release, prompting some organizations, including government websites, to temporarily take their sites offline as a precaution.
• Agencies such as the EU-CERT, UK’s NCSC, and the FBI urge immediate patching of PHP systems, especially those exposed to the internet, and recommend isolating and reporting compromised systems to mitigate the widespread threat.
• The vulnerabilities were partially discovered using AI tools, highlighting the urgent need for swift updates, as attackers could exploit the flaws quickly and on a large scale, potentially causing significant disruption to internet infrastructure.