GoKawiilPHP Foundation issues emergency patches for two critical remote-execution flaws
The PHP Foundation released emergency updates on Wednesday to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could let attackers remotely take control of affected systems. The flaws affect all PHP installations serving web requests dating back to PHP 5 from 2004, though only PHP 8.2 and newer will receive official patches, with some legacy fixes available through third-party vendors.
GoKawiil's interpretation of the reporting above, not reported fact.
PHP underlies huge portions of the web, including platforms like WordPress, Drupal and Magento, so unpatched systems could expose a vast attack surface. Security consultant Lukasz Olejnik warns that if attackers move quickly, the result could be wormable malware spreading across large parts of the internet, though this remains a worst-case scenario rather than a certainty. The risk is compounded by older, unsupported PHP versions that may persist unnoticed in legacy infrastructure.
- Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) allow potential remote system takeover.
- Only PHP 8.2 and later versions will receive official patches, leaving older installations reliant on third-party fixes.
- Experts warn fast exploitation could enable wormable malware to spread widely across internet infrastructure.
Source: wired.com — Matt Burgess, 2026-10-21
Published there as: “‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.