PHP releases emergency patches for two critical remote-code flaws
publishers 13articles 15first reported 21 Oct, 02:12 UTCdeveloping since 21 Oct · 9 editions
PHP developers released emergency updates Wednesday for two critical vulnerabilities that could allow unauthenticated attackers to execute code remotely on web servers. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, each received a severity score of 9.2 out of 10.
The PHP Foundation said the vulnerabilities affect PHP installations serving web requests dating back to PHP 5. Official fixes were issued for supported branches in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Administrators were urged to update immediately, with the foundation warning that there are no complete alternative mitigations. Updating WordPress or other PHP-based applications alone does not patch the underlying PHP software.
Cloudflare said it observed early attacks targeting the flaws and deployed firewall protections, while emphasizing that customers still need to install the PHP updates. Security agencies in the European Union, United Kingdom, Australia and the United States advised organizations unable to patch promptly to isolate affected services or temporarily take them offline.
Government and public-service websites in several countries, including Finland, the Netherlands, France, Germany and Belgium, were taken offline as a precaution. The Wikimedia Foundation also disabled some systems while applying fixes, temporarily affecting access to parts of Wikipedia. Those shutdowns did not necessarily indicate that the sites had been compromised.
Security firms Calif and Wiz reported discovering the flaws using OpenAI technology. PHP developers had been preparing fixes confidentially before information about the vulnerabilities leaked ahead of the scheduled release.
HOW THIS STORY WAS MADE
Written from 8 articles, 8 with the publisher's own text; 8 independent newsrooms once syndicated copies count as one; this version written 12 h after the record first saw the story; the editor kept it as written.
- Publishers
- 13
- Source articles
- 15
- Given to the writer
- 8, 8 with the article's own text
- Independent newsrooms
- 8
- This version written
- 12 h after the record first saw the story
- Second model (editor)
- kept as written
- Publication gate
- passed
- Human review
- none
WHAT THE EDITOR DID
The second model checked the writer's draft against the same sources and published it as written.
Written by a language model from the sources above, then checked by a second model that may only cut, attribute or correct. How it works →