Critical PHP Vulnerabilities Expose 70% of Websites to Cyber Attacks

Hacktron.Ai

Critical PHP Vulnerabilities Expose 70% of Websites to Cyber Attacks

First seen 22 Oct 2026, 15:43 UTC • •72.9

Article Content

1 / 38

Browse articles

ThreatCluster •October 22, 2026 at 18:14 UTC

•CVE-2026-109618 and CVE-2026-109619 allow remote code execution on PHP-powered sites.
•Over 70% of websites, including major platforms like WordPress, are at risk.
•Governments worldwide have temporarily shut down services to mitigate potential attacks.

Two critical vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21 and 22, 2026, respectively. These flaws allow unauthenticated remote code execution, potentially affecting around 70% of websites globally. Following the announcement, millions of hacking attempts were reported as attackers sought to exploit the vulnerabilities. Governments and organizations worldwide, including the UK and Japan, have taken numerous websites offline as a precautionary measure while they implement security patches. The PHP Foundation has released emergency updates, urging all users to apply them immediately. The vulnerabilities were discovered using AI by researchers from Wiz and Calif, marking a significant moment in cybersecurity. The situation is evolving rapidly, with ongoing monitoring and updates from cybersecurity agencies.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-10-21

CVE-2026-109619 published

The first critical PHP vulnerability was disclosed, allowing remote code execution.

2026-10-22

CVE-2026-109618 published

The second critical vulnerability was disclosed, prompting immediate patching efforts.

2026-10-22

Global websites taken offline

Governments and organizations began taking websites offline to address the vulnerabilities.

More articles in this cluster (37)

Following this threat?

Track Amazon and CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Common questions

What systems are affected by these vulnerabilities?

The vulnerabilities affect all versions of PHP, impacting approximately 70% of websites globally.

What should organizations do immediately?

Organizations should identify systems running PHP and apply the latest security patches released by the PHP Foundation.

Is there evidence of active exploitation?

Yes, millions of hacking attempts have been reported since the vulnerabilities were disclosed.

Continue Reading

Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 Disclosed On October 20, 2026, two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed, allowing unauthenticated remote code execution (RCE) on affected systems. The vulnerabilities, collectively known as 'PHP2Shell', stem from improper memory handling during HTTP request processing…

Critical PHP Vulnerabilities PHP2Shell Prompt Urgent Global Response On October 21, 2026, the PHP Foundation disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS scale. These vulnerabilities allow unauthenticated remote code execution (RCE) on affected servers, impacting millions of websites powered by PHP, including major platforms…