PHP Security Vulnerabilities Put Websites at High Risk
Summary
Two critical vulnerabilities in PHP are putting millions of websites at risk, with hackers already exploiting the flaws after details leaked early. Governments and organizations in Australia, Japan, Europe, France, Germany, Belgium, and the United States have taken precautionary steps, including taking systems offline.
Key Points
- Two serious PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, can let hackers take remote control of servers without a password.
- Developers released a patch and urged all users to update immediately after the flaws were discovered and later leaked ahead of schedule.
- Australia, Japan, and several European government systems were taken offline as a precaution, while Wikimedia Foundation also shut down some systems.
- The US NSA advised keeping systems offline if updates cannot be applied immediately, and the White House ordered agencies to assess the impact.
