Critical PHP Vulnerabilities Spark Global Cybersecurity Alert

• •Two critical PHP vulnerabilities allow unauthenticated remote code execution.
• •Approximately 70% of websites are at risk, prompting urgent patching efforts.
• •Hackers have already begun probing for exploits, raising concerns of mass exploitation.

On October 21, 2026, the PHP Foundation disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting approximately 70% of websites globally. These flaws allow unauthenticated remote code execution, enabling attackers to execute malicious code on vulnerable servers. The vulnerabilities were discovered with the assistance of AI tools, leading to immediate patch releases and widespread precautionary shutdowns of websites, including those of various governments in Europe. As of October 22, reports indicate that hackers have begun probing for exploits, with some attempts already noted. Cybersecurity agencies worldwide are urging all PHP users to update their systems immediately or take them offline until patches can be applied. The situation is evolving rapidly, with the potential for mass exploitation if not addressed promptly.