Critical PHP vulnerabilities prompt emergency patches affecting up to 70% of websites

On October 21, 2026, the PHP Foundation released emergency security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, rated 9.2 out of 10. Discovered using AI tools by OpenAI, Calif, and Google's Wiz, the flaws impact 70% of websites running PHP 5 and newer. As active exploits emerged, cybersecurity agencies urged immediate patching, prompting Finnish and Dutch governments to take major websites offline.

PHP vulnerability details and patch release

• ▪The two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, carry a severity rating of 9.2 out of 10 on the Common Vulnerability Scoring System
• ▪The two critical security flaws, CVE-2026-109618 and CVE-2026-109619, impact all PHP installations serving web requests going back to PHP version 5, released in July 2004
• ▪The critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 allow unauthenticated attackers to execute arbitrary code or read sensitive server process memory, including passwords, API keys, and certificates
• ▪The PHP Foundation stated that updating to PHP 8.2 or newer is the only safe mitigation, as older versions like PHP 8.1 no longer receive official patches
• ▪The PHP Foundation released emergency security updates on October 21, 2026 at 10:00 AM ET to address two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619

Widespread exposure across web platforms

• ▪Popular web platforms including WordPress, Drupal, Joomla, and Adobe's Magento rely on PHP, exposing millions of content management and e-commerce deployments
• ▪PHP powers approximately 70% of all websites on the internet, representing over 33 million sites and more than 1.3 million internet-connected hosts

Vulnerability discovery using artificial intelligence

• ▪Google-owned security company Wiz independently discovered the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 using AI tools including its Wiz Atlas agent, Gemini 4 Argon, and GPT-5.6 Sol
• ▪Wiz researchers noted that while AI helped identify the ancient PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, large language models also lower the barrier for attackers to adapt exploits across different server configurations

Cybersecurity firm warnings and observations

• ▪Wordfence warned that WordPress site owners must apply PHP patches manually through their web hosting providers because automatic WordPress updates cannot update the underlying PHP installation
• ▪Cybersecurity firm Sansec warned that mass automated attacks against unpatched PHP installations were expected to begin within 15 minutes of the PHP Foundation's patch release

Government agency security advisories

• ▪The United Kingdom's National Cyber Security Centre and the EU Computer Emergency Response Team advised organizations to prepare for immediate patching or isolate vulnerable systems affected by the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 offline
• ▪FBI Cyber Assistant Director Brett Leatherman instructed compromised organizations to isolate systems, preserve web server logs, and report incidents to local FBI field offices

Precautionary website shutdowns by organizations

• ▪Dutch government websites, including the Dutch House of Representatives and the Dutch National Cyber Security Centre, went offline due to PHP security precautions and third-party software provider Notubiz
• ▪Mobile operating system developer GrapheneOS and universities in Germany and Austria, including the University of Vienna, took public websites offline to mitigate risk from emerging exploits of the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619
• ▪The Finnish government took its public-facing internet services offline as a precautionary measure in response to security warnings about the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619