The IT industry is bracing for widespread cyberattacks due to a pair of severe flaws found in PHP, a scripting language widely used to operate millions of websites.
The threat emerged on Tuesday after an anonymous user warned that two newly discovered vulnerabilities in PHP can be exploited to execute rogue code, enabling hackers to tamper with websites and servers that use the scripting language.
The PHP Foundation, which maintains the language, has since confirmed that both flaws can lead to unauthenticated remote code execution. “All PHP users are strongly encouraged to update immediately,” the group said.
The foundation has released patches, but only for PHP 8.2 and up. That’s a problem because the two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, also affect older PHP versions 5, 6, 7, and 8.1, according to the UK’s National Cyber Security Center (NCSC-UK).
The fear is that hackers will quickly swoop in and develop exploits to attack the vulnerabilities before websites can roll out their own fixes. PHP works by “running on a web server to generate dynamic page content, interact with databases, and handle backend application logic before delivering the final HTML output to a user’s browser,” the NCSC-UK noted.
This Tweet is currently unavailable. It might be loading or has been removed.
The US National Security Agency adds: “These vulnerabilities often provide a direct path to the server’s file system or database. If an immediate update is not feasible, it is recommend[ed] that organizations take the system offline.”
CERT-EU, another cybersecurity group in Europe, echoed the recommendation, posting: “Where immediate remediation is not feasible, organizations should consider isolating internet-facing applications from public networks until a fix can be applied.”
The PHP Foundation also says there’s already a “demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.”
Recommended by Our Editors
Cloudflare, a web infrastructure provider, has deployed new firewalls for customers, but CTO
Dane Knecht warned: “We are seeing early attacks emerging and are updating mitigations as new vectors show up.” The National Cyber Security Center in the Netherlands even went as far as to pull its site offline as a precaution.
PHP is estimated to power nearly 70% of websites where the scripting language can be identified. Wikipedia and WordPress are two major users. Another estimate puts the number of sites using PHP at about 24 million.
For companies on older versions, the PHP Foundation says: “Some distributions and LTS (long-term support) vendors provide backported fixes, so contact your vendor for details, or upgrade to a supported version.”
About Our Expert
Michael Kan
Principal Reporter
Experience
I’ve been a journalist for over 15 years. I got my start as a schools and cities reporter in Kansas City and joined PCMag in 2017, where I cover satellite internet services, cybersecurity, PC hardware, and more. I’m currently based in San Francisco, but previously spent over five years in China, covering the country’s technology sector.
Since 2020, I’ve covered the launch and explosive growth of SpaceX’s Starlink satellite internet service, writing 600+ stories on availability and feature launches, but also the regulatory battles over the expansion of satellite constellations, fights with rival providers like AST SpaceMobile and Amazon, and the effort to expand into satellite-based mobile service. I’ve combed through FCC filings for the latest news and driven to remote corners of California to test Starlink’s cellular service.
I also cover cyber threats, from ransomware gangs to the emergence of AI-based malware. In 2024 and 2025, the FTC forced Avast to pay consumers $16.5 million for secretly harvesting and selling their personal information to third-party clients, as revealed in my joint investigation with Motherboard.
I also cover the PC graphics card market. Pandemic-era shortages led me to camp out in front of a Best Buy to get an RTX 3000. I’m now following how the AI-driven memory shortage is impacting the entire consumer electronics market. I’m always eager to learn more, so please jump in the comments with feedback and send me tips.
Leave a Reply