Emergency PHP Patches Deployed After AI-Discovered Flaws Threaten Global Web
The PHP Foundation released emergency security updates on Wednesday to address two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which allow unauthenticated attackers to execute remote code. Rated 9.2 on the CVSS scale, these flaws affect all PHP versions from 5.4 onward, though only versions 8.2 through 8.5 receive official patches. The release was accelerated after details leaked online, prompting governments and tech firms to take systems offline. Security experts warn that the widespread use of PHP, which powers roughly 70% of websites, creates a massive attack surface, with some describing the risk as comparable to the 2014 Heartbleed bug.
