Skip to content
Critical PHP Vulnerabilities Expose Millions of Websites to Cyber Attacks

Critical PHP Vulnerabilities Expose Millions of Websites to Cyber Attacks

First seen 22 Oct 2026, 15:43 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 22, 2026 at 17:14 UTC
  • •Two critical PHP vulnerabilities affect 70% of websites globally.
  • •Exploitation attempts surged to millions within hours of disclosure.
  • •Immediate patching is essential to prevent potential breaches.

The FBI and cybersecurity experts have warned of two critical vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619, which could allow remote code execution on affected web servers. Discovered on October 21, 2026, these flaws affect approximately 70% of websites globally, including major platforms like WordPress and Magento. Following the announcement, there was a dramatic increase in hacking attempts, with millions of attempts reported within hours. Governments and organizations worldwide have begun taking systems offline as a precaution while patches are being implemented. The vulnerabilities were uncovered using AI, highlighting the dual-use nature of such technology in both security and exploitation. The PHP Foundation has released patches and urged immediate updates to mitigate risks. Organizations are advised to monitor their systems for unusual activity and report any breaches to authorities.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-21
CVE-2026-109619 published
The first critical vulnerability in PHP was disclosed, allowing remote code execution.
Punchng
2026-10-21
CVE-2026-109618 published
The second critical vulnerability in PHP was disclosed, also allowing remote code execution.
Punchng
2026-10-22
Mass exploitation attempts reported
Cloudflare reported millions of hacking attempts following the vulnerabilities' announcement.
Theedgemalaysia
2026-10-22
Global websites taken offline
Governments and companies worldwide began taking their websites offline to patch vulnerabilities.
Ctvnews

More articles in this cluster (17)

Following this threat?

Track PHP Foundation and CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (15)

1 / 4

Common questions

What are the CVEs associated with this vulnerability?
The vulnerabilities are identified as CVE-2026-109618 and CVE-2026-109619.
How urgent is the patching process?
Patching is urgent due to the high volume of exploitation attempts reported shortly after the vulnerabilities were disclosed.
What should organizations do if they suspect a breach?
Organizations should isolate affected systems, preserve logs, and report the incident to local authorities.