Critical PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619) Pose Major Internet Security Threat

Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) enabled remote code execution without authentication, threatening 70% of web-facing systems. The PHP Foundation coordinated emergency patches to mitigate widespread exploitation across critical infrastructure.

Two critical bugs in the PHP web programming language, used by the majority of the internet, threatened to upend the internet — and it's unlikely to be the last major software scare.

Read original article