Internet security and Web administration teams around the world are scrambling to avoid widespread disaster. On Wednesday, the developers of the widely used PHP programming language released emergency security updates designed to fix critical flaws that could be exploited to allow attackers to gain dangerous remote control of victim systems.
The PHP Foundation detailed the two critical vulnerabilities – CVE-2026-109618 and CVE-2026-109619 – that affect “all PHP installations serving web requests” since PHP version 5, released in July 2004. However, only PHP 8.2 and newer are still supported and will receive patches, according to the alert. The PHP Foundation noted, however, that some PHP distributions and third-party vendors still produce legacy patches. The caveat is important because ubiquitous and foundational web layers like PHP can persist forgotten and unedited in the historic Internet infrastructure.
“There are no comprehensive mitigation measures, updating is the only safe choice,” the PHP Foundation writes in its advisories. Security experts warn of potentially disastrous consequences of neglecting unpatched systems.
“It’s not an exercise,” says Lukasz Olejnik, an independent security consultant and visiting senior fellow at King’s College London. Since its development in the 1990s, PHP has become an essential scripting language for web development and is used across large swaths of the Internet in websites and software. Everything from publishing systems like WordPress and Drupal to e-commerce platforms like Adobe’s Magento are built on PHP.
Olejnik compares the widespread use of the programming language to critical infrastructure.
“The impact is huge,” he said of the PHP security flaws, adding that millions of systems could be impacted. “Especially if attackers quickly turn to exploiting these vulnerabilities. In the worst case, dewormable malware affects large parts of the Internet.”
The main fear of security teams and developers is that malicious hackers can quickly exploit vulnerabilities and begin exploiting deployments before they are patched. Internet infrastructure company Cloudflare reported that it was “seeing early attacks” before the PHP Foundation detailed the vulnerabilities and released patches. “We expect massive attacks to begin within 15 minutes of release,” security firm Sansec wrote ahead of the patches, which were released shortly before 10 a.m. ET on Wednesday.
“Most of the web runs on PHP, and this bug is in a file upload interface that looks like a front door without a lock,” says Davi Ottenheimer, a longtime security and compliance consultant. “An attacker doesn’t need to know what site they’re accessing or even the actual software they’re running. They send a counterfeit download to any server they can find, and that’s the entire attack.”
Gn bussni
