Tribune.Pk Critical PHP Vulnerabilities Prompt Global Security Response
Article Content
- •Two critical PHP vulnerabilities disclosed, CVE-2026-109618 and CVE-2026-109619, with CVSS 9.2.
- •PHP Foundation operates with one full-time staff member, emphasizing its funding challenges.
- •Global response includes urgent patching and temporary shutdowns of several government websites.
The PHP Foundation disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, on October 21, 2026, with a CVSS score of 9.2. These flaws could allow attackers to take over servers, prompting urgent patching efforts worldwide. The foundation operates with only one full-time employee, highlighting its underfunded status despite PHP's critical role in powering up to 70% of websites globally. Following the disclosure, mass scanning and exploitation attempts were reported, although no successful compromises have been confirmed. The vulnerabilities were publicly disclosed after a leak, leading to heightened security measures, including the temporary shutdown of several government websites in Europe. A third flaw, CVE-2026-115560, was identified shortly after, but it is considered less likely to be exploited in practice. Organizations are urged to apply the available patches immediately to mitigate risks.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track Calif and CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
Which versions of PHP are affected?
Is there evidence of exploitation in the wild?
What should organizations do to protect themselves?
Continue Reading
Lazarus Group Linked to PHP Vulnerability Exploitation Plans A cybersecurity report from Cyfirma indicates that a group suspected to be linked to North Korea's Lazarus Group is preparing to exploit critical vulnerabilities in PHP, specifically CVE-2026-109618 and CVE-2026-109619, which allow unauthenticated remote code execution. The attackers, communicating in Korean, are… 
Japan Issues Warning Over Critical PHP Vulnerabilities Affecting Government Sites Japanese Prime Minister Sanae Takaichi announced critical vulnerabilities in the PHP programming language, widely used on government and commercial websites. The vulnerabilities, CVE-2026-109619 and CVE-2026-109618, both rated CVSS 9.2, were disclosed on October 21, 2026, with proof-of-concept code for CVE-2026-109618…