PHP Foundation releases emergency patches for two critical vulnerabilities affecting all versions since 2004

The PHP Foundation announced emergency security updates on Wednesday to address two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that affect all PHP installations serving web requests dating back to version 5 released in 2004. Only PHP 8.2 and newer will receive official patches, though some third-party vendors continue to provide fixes for older versions.

"There are no complete mitigations, updating is the only safe choice," the foundation wrote in its advisory.

Security researchers warned that the flaws could allow unauthenticated attackers to execute code on affected servers or read sensitive memory, potentially exposing passwords, tokens and certificates. Independent consultant Lukasz Olejnik described the vulnerabilities as comparable to critical infrastructure, noting that millions of systems could be at risk.

"Everybody should patch immediately, exploitation may happen very fast and at a scale," Olejnik said.

Cloudflare reported early signs of attacks before the patches were released, and security firm Sansec predicted mass exploitation within minutes of the update. Some organizations, including Finnish government sites, French ministries and the Port of Rotterdam, temporarily took their websites offline as a precaution.

The UK National Cyber Security Centre and other national agencies issued alerts urging rapid remediation or temporary shutdown of vulnerable systems. The FBI’s cyber assistant director advised organizations to isolate compromised servers, preserve logs and report incidents to local FBI field offices.

Wiz, a security company owned by Google, said its researchers discovered the flaws using AI tools, while OpenAI and other firms also reported independent findings. The vulnerabilities received a CVSS score of 9.2, indicating a critical severity level.