From WIRED · Matt Burgess · · 2m
Critical PHP flaws put millions of websites at risk
Two emergency security vulnerabilities in PHP could allow attackers to remotely control web servers. Only immediate patching will stop widespread exploitation.
In brief
Two emergency security vulnerabilities in PHP could allow attackers to remotely control web servers. Only immediate patching will stop widespread exploitation. The PHP Foundation released emergency patches for two critical vulnerabilities affecting all PHP installations since version five, with security experts…
Two critical PHP flaws disclosed
The PHP Foundation released emergency security updates on Wednesday to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could allow attackers remote control of victim systems.
Vulnerabilities affect vast PHP infrastructure
The flaws impact all PHP installations serving web requests going back to PHP version five, released in July two thousand four.
PHP powers the modern web
PHP is used across vast swaths of the internet in websites and software. Publishing systems like WordPress and Drupal and e-commerce platforms like Adobe's Magento are built on PHP.
Security expert warns of scale
Lukasz Olejnik, an independent security consultant and visiting senior research fellow at King's College London, says millions of systems could be impacted. Worst case is wormable malware affecting big chunks of the internet.
“This is not a drill”
Attacks expected within minutes
Cloudflare reported seeing early attacks emerging before fixes were released. Security firm Sansec expected mass attacks to start within fifteen minutes of the release, which came just before ten am ET on Wednesday.
“An attacker does not need to know which site they are hitting or even the actual software it runs.”
Governments take sites offline
Ahead of updated PHP versions becoming available, some organizations took websites offline as a precautionary measure.
What the vulnerabilities expose
Security company Wiz says the vulnerabilities can allow unauthenticated attackers to execute code on affected servers or read sensitive process memory. That memory may contain passwords, authentication tokens, API keys and certificates.
Agencies urge immediate action
The UK's National Cyber Security Center advised organizations to prepare for immediate updating of systems using PHP.Where immediate remediation is not feasible, organizations should consider taking the system offline until it can be fully mitigated.
Report compromised systems to FBI
Brett Leatherman, the FBI's cyber assistant director, said if organizations find signs of compromise they should isolate the system, preserve logs, and report it to their local FBI field office.
The main idea
The PHP Foundation released emergency patches for two critical vulnerabilities affecting all PHP installations since version five, with security experts warning of potential mass exploitation if systems are not updated immediately.
