Two critical PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, could let an attacker execute code of their choosing on a vulnerable server, according to the source report. PHP released an emergency security update to fix them.
The report says the flaws affect all web servers running PHP 5.4 or later. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
The source says experts report working exploits exist and that the bugs are already being exploited in the wild. Cloudflare said it has detected some exploitation and implemented web application firewall rules at 3:02 am (UTC). Reuters reports that government websites in Europe and elsewhere went offline after the disclosure. The report does not say whether the outages were caused by the flaws.
Censys said a recent scan identified about 2.58 million Internet-facing hosts and 54.9 million web properties running PHP. The source says nearly 70 percent of websites need to update their core software, though it does not identify the basis for that figure.
Security researchers at Wiz said every PHP version released in the last decade is affected by at least one of the vulnerabilities. Wiz said it is likely the flaws will be