PHP Foundation releases emergency patches for two critical vulnerabilities
AIThe PHP Foundation released emergency security updates on Wednesday for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which it says affect all PHP installations serving web requests back to PHP 5. Only PHP 8.2 and newer still receive official patches, while some distributions and vendors provide legacy fixes, and the foundation says there are no complete mitigations.
AIWhy it matters.
The article covers which PHP versions are patched, which web platforms are exposed, and how sites are going offline, giving context for an urgent security response.
Source details
Wired · AI · Matt Burgess, Lily Hay Newman · wired.comPublished · added here
Original title: ‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire