Newly disclosed PHP vulnerabilities raise cybersecurity concerns worldwide

Two newly disclosed critical vulnerabilities in PHP have prompted emergency security updates and precautionary shutdowns of websites in across Europe and the US. It raises questions for organisations about their exposure through websites, applications and third-party hosting services.

Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws could allow unauthenticated attackers to execute malicious code on affected servers under certain configurations. Both carry a severity score of 9.2 out of 10, although the risk depends on the PHP version and deployment configuration rather than simply whether a website uses the language.

The PHP development team released emergency updates on 21 October. Government agencies in the Netherlands and Finland temporarily disabled websites as a precaution, according to Reuters. The shutdowns did not establish that those services had been compromised.

PHP supports websites and applications built on widely used platforms, including WordPress, Drupal and Joomla. Its presence across hosting environments and third-party software makes identifying affected installations an important part of the response.

Urgent patching, careful verification

Chris Yule, Senior Director of Threat Research, Sophos Counter Threat Unit, commented:

“Our research backs up what others are confirming, that these techniques can be used to predictably corrupt memory and bypass some implementation of ASLR protections in PHP. With AI accelerating the weaponisation process, attackers can potentially move to working exploits much faster, leaving defenders with an increasingly narrow window to respond. The research and disclosure give defenders something concrete to work from, but the harder problem is older systems and appliances running vulnerable versions of PHP that can’t simply be updated or replaced.”

Don Smith, VP of Threat Intelligence at Sophos Counter Threat Unit also observed, “The immediate challenge is not simply installing a patch, but finding and managing every instance where PHP is running. The use of PHP is pervasive, it can sit beneath public websites, content management systems, hosting platforms and third-party products, sometimes without even being obvious to the organisation using it.

Don’s advice goes as follows, “Security teams should prioritise internet-facing systems, confirming which versions are affected as soon as the official advisory is published, and apply the updates without delay. And in line with the advice from NCSC, any vulnerable system that cannot be patched should be isolated from the internet until it can be secured.

He also added that since “Threat actors move fast, especially with the help of AI”… “it is crucial organisations monitor PHP and web-server processes for unusual processes, command execution or other signs that an attacker may already have gained a foothold.”

CEO and co-founder of Filigran, Samuel Hassine, also shares similar precautions to take, “The hard part is not installing the patch, it is knowing where PHP runs: beneath content management systems, hosting platforms, appliances and third-party products that never advertise it. That is why governments are taking sites offline rather than waiting. The speed cuts both ways. AI found flaws that sat unnoticed for more than a decade, and the same tools let attackers build working exploits in hours, with early attacks already reported.

“Security leaders should do three things today. Inventory every exposed system and ask each vendor whether their product bundles PHP. Patch or isolate what you cannot patch, starting with anything reachable from the internet. Then assume someone got in first: hunt for web shells, unexpected files and new outbound connections. A fix only counts once you have proven it is applied everywhere an attacker can reach.”