Widespread PHP Flaw May Cause Many Site Outages Today – Krebs on Security

A pair of critical vulnerabilities in the PHP programming language, tracked as CVE-2026-109618 and CVE-2026-109619, is already being actively exploited, prompting PHP's maintainers to rush out emergency patches. The flaws affect every PHP release from version 5.4 onward and allow attackers to run arbitrary code on vulnerable servers, putting an estimated 70 percent of websites — including those built on Drupal, Magento, Joomla, and WordPress — at risk. Cloudflare says it has already observed attack attempts and deployed firewall rules to block exploitation attempts that could lead to denial of service, remote code execution, or data theft, while some government sites in Europe have already been taken offline as a precaution. Researchers at Wiz, who helped discover and coordinate disclosure of the bugs alongside OpenAI and the PHP team, warn the flaws could be mass-exploited to plant web shells and compare their severity and reach to the 2021 Log4Shell crisis; administrators are urged to update immediately to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35.