Two critical vulnerabilities in the PHP scripting language have triggered a global security response, as the flaws could allow unauthenticated remote code execution, according to ARN.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, carry a severity rating of 9.2 on the Common Vulnerability Scoring System. These flaws reside in core memory management and error-handling components, affecting nearly all PHP installations, including PHP-FPM and Apache with mod_php. Because PHP powers approximately 70% of websites and is embedded in various network appliances, the potential impact is widespread.
The PHP Foundation has released updates for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, urging immediate deployment. Some European government websites were taken offline as a precautionary measure to prevent exploitation. Security experts warn that while patching is essential, organizations must also investigate for signs of prior compromise. The discovery was aided by artificial intelligence, which researchers used to identify the flaws before they could be weaponized. However, analysts caution that attackers are likely using similar AI tools to develop exploits, making rapid remediation critical to maintaining operational resilience across the internet.
Source: Arn Net
