Critical PHP Flaws Force Global Security Patches and Widespread Service Disruptions

Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been identified in the PHP scripting language, carrying a severity score of 9.2. These flaws enable remote code execution, prompting widespread service outages as organizations proactively take systems offline to mitigate potential exploitation.

Multiple national governments and cybersecurity agencies have issued urgent advisories, citing the pervasive use of PHP across enterprise networks and public-facing infrastructure. Security researchers report that exploitation attempts are already occurring in the wild, facilitated by AI-driven tools that accelerate the development of functional exploits.

A significant institutional risk remains for systems running legacy versions of PHP, specifically those prior to version 8.2, which no longer receive security updates. Organizations are advised to prioritize the identification of all internet-facing PHP instances and to isolate unpatchable legacy systems to prevent unauthorized access to sensitive business logic and customer data.