Internet-Wide — Critical PHP Flaws Prompt Emergency Website Patches

The PHP Foundation released emergency patches Wednesday for two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, that researchers said could let attackers take remote control of web servers running the widely used programming language, according to Wired. The foundation's advisories describe flaws that affect every PHP installation serving web requests, a reach that spans publishing platforms, e-commerce sites and custom web applications built over more than two decades.

What are CVE-2026-109618 and CVE-2026-109619?

The PHP Foundation disclosed both vulnerabilities on Wednesday alongside the fixes, rather than giving administrators advance notice, Wired reported. The foundation's own language left little room for partial fixes: "There are no complete mitigations, updating is the only safe choice," the advisories state, according to Wired. Davi Ottenheimer, a longtime security and compliance consultant, told Wired that one of the flaws sits in a file upload interface, which he compared to "a front door with no lock." He said an attacker does not need to know what software a target server runs before exploiting it. "They send one crafted upload to any server they can find, and that is the entire attack," Ottenheimer said.

Which PHP versions and systems are exposed?

The PHP Foundation said the underlying flaws trace back to PHP version 5, released in July 2004, meaning the vulnerable code has been present in some form for more than two decades, Wired reported. Only PHP 8.2 and newer versions remain officially supported and will receive patches directly from the foundation. Older, unsupported branches fall outside that coverage, though the foundation noted that some PHP distributions and third-party vendors continue to issue their own legacy fixes, according to Wired. Because PHP underpins widely deployed software — including publishing systems such as WordPress and Drupal and e-commerce platforms such as Adobe's Magento — the practical exposure extends well beyond sites that administrators actively maintain.

How severe do researchers say the risk is?

Lukasz Olejnik, an independent security consultant and visiting senior research fellow at King's College London, told Wired the scale of potential impact is "enormous," estimating that millions of systems could be affected.

"This is not a drill." — Lukasz Olejnik, independent security consultant and visiting senior research fellow at King's College London

Olejnik said the greatest danger is speed: if attackers move quickly to weaponize the flaws before organizations patch, the result could be "wormable malware affecting big chunks of the internet," he told Wired. That assessment matches what infrastructure companies reported seeing in real time. Cloudflare told Wired it was "seeing early attacks emerging" even before the PHP Foundation had publicly detailed the vulnerabilities. Separately, the security firm Sansec wrote ahead of the fixes' release that it expected "mass attacks to start within 15 minutes of the release," according to Wired. The patches became available just before 10 a.m. ET on Wednesday.

What are administrators being told to do now?

The PHP Foundation's guidance, as relayed by Wired, is unambiguous: update supported installations immediately, since no partial workaround exists. Some organizations did not wait to confirm whether they had already been targeted. Wired reported that multiple websites took themselves offline as a precaution ahead of the fixes going live, choosing downtime over the risk of running unpatched code while attackers were actively probing for vulnerable servers.

Why does PHP's age complicate the response?

The difficulty of this patch cycle is tied directly to how long PHP has been embedded in internet infrastructure. Olejnik likened the language's ubiquity to critical infrastructure in comments to Wired, noting that foundational web layers like PHP can persist, forgotten and un-updated, inside older systems long after active developers have moved on. Because the vulnerable code traces back to a 2004 release and unsupported versions will not receive official fixes, security teams face a mapping problem as much as a patching one: finding every legacy PHP instance still serving web requests, including those running on software stacks administrators may not realize depend on PHP at all. That gap between what is patched and what quietly keeps running unpatched is, according to the researchers Wired interviewed, the condition that turns a single software bug into a risk to large sections of the web.