Critical PHP Bug Puts Millions of Websites at Risk
Your favorite sites may be vulnerable—here's what you need to know.
The PHP Foundation released emergency security updates for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which impact “all PHP installations serving web requests” back to PHP version 5. Only PHP 8.2 and newer are still supported and will receive patches, though the foundation noted some distributions and third-party vendors still produce legacy fixes.
The foundation said there are no complete mitigations and that updating is the only safe choice. Experts warn millions of systems could be impacted and that attackers may exploit the flaws fast; Cloudflare reported early attacks before the vulnerabilities were detailed and fixes released, and Sansec expected mass attacks within 15 minutes of release.
Wiz said unauthenticated attackers could execute code on affected servers or read sensitive process memory that may contain passwords, authentication tokens, API keys, and certificates. Some Finnish government sites, French government websites, and the Port of Rotterdam’s website were offline as a precaution.
- PHP is used by most websites, including WordPress and Drupal, so the flaw affects millions of sites.
- Attackers can exploit the bug easily, potentially stealing passwords and taking over servers.
- Patches are available for supported versions, but older versions remain vulnerable and must be updated or taken offline.
Why It Matters
Your personal data on websites could be at risk; businesses must update immediately to prevent breaches.