Two critical PHP vulnerabilities impact millions of websites dating back to 2004; experts warn attackers could exploit flaws within minutes, urge immediate patching to prevent remote takeover of servers.

‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire

Internet security and web administration teams around the world are scrambling to prevent widespread disaster. On Wednesday, the developers behind the much-used PHP programming language released emergency security updates designed to fix critical flaws that could be exploited to allow attackers to gain dangerous remote control of victim systems.The PHP Foundation detailed the two critical vulnerabilities—CVE-2026-109618 and CVE-2026-109619—which impact “all PHP installations serving web requests...