‘This Is Not A Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire
wired ·
The PHP Foundation has disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that affect all PHP installations serving web requests since version 5. These flaws allow unauthenticated attackers to execute code or read sensitive memory containing passwords and API keys on affected servers. Security experts warn that the widespread use of PHP in essential infrastructure like WordPress and Magento makes these bugs particularly dangerous. Early attacks were already detected by Cloudflare before the official patch release, prompting fears of rapid, wormable malware spread. Consequently, several government websites in Finland, France, and the Netherlands went offline as a precautionary measure. The UK’s NCSC and other agencies have urged organizations to apply updates immediately or disconnect systems if patches are not yet available. Researchers from Wiz, OpenAI, and Calif contributed to identifying these issues, with some discoveries aided by AI tools. Authorities emphasize that updating is the only safe mitigation, as no complete workaround exists for the current threat landscape.
wired