Critical PHP flaws prompt EU and UK agencies to warn webmasters to patch or go offline
The PHP Foundation is releasing emergency patches for two critical vulnerabilities rated 9.2 on the CVSS scale, affecting the programming language used by a vast portion of the internet. Cybersecurity agencies in the EU, UK, and Australia have urged organizations to apply the fixes immediately or take websites offline. Early attacks are emerging, with unconfirmed reports suggesting the flaws, tracked as CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution across multiple PHP versions.
Key points
- The PHP Foundation, which supports the widely used programming language, scheduled the release of patches for two critical vulnerabilities for Wednesday, October 21, 2026, at 1400 GMT.
- Both vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, were rated 9.2 on the CVSS v4.0 severity scale, indicating a high risk of unauthenticated remote code execution.
- Cybersecurity agencies, including the UK's National Cyber Security Centre and the EU's CERT-EU, advised organizations to upgrade immediately or take affected systems offline if immediate remediation is not feasible.
- Dane Knecht, CTO of Cloudflare, stated that early attacks are emerging and the company is updating firewall rules as a stopgap measure while waiting for the official patch.
- Unconfirmed reports from security firm watchTowr suggest the vulnerabilities affect every PHP version from PHP 5, released in 2004, onward, impacting major platforms like WordPress, Drupal, and Magento.
- The Netherlands' cybersecurity agency took its own website offline as a precaution, while Huntress noted that PHP quietly powers a significant amount of software that does not explicitly advertise its use of the language.
The PHP Foundation announced on Wednesday that it would release emergency patches for two critical vulnerabilities in the PHP programming language, a core component of the global web infrastructure. Both flaws, identified as CVE-2026-109618 and CVE-2026-109619, carry a severity rating of 9.2 on the CVSS v4.0 scale. The patches were scheduled for release at 14:00 GMT on October 21, 2026, following a leak of purported exploit details that prompted the maintainers to accelerate the timeline.
Cybersecurity officials in the European Union, the United Kingdom, and Australia have issued urgent guidance to organizations relying on PHP. The UK's National Cyber Security Centre and the EU's CERT-EU warned that the vulnerabilities indicate a potential for unauthenticated remote code execution, which could allow attackers to install malware or take down websites. For organizations unable to apply the fixes immediately, officials recommended taking affected systems offline to mitigate risk. The Netherlands' cybersecurity agency adopted this approach, temporarily taking its own website offline.
The scope of the impact is significant, as PHP powers major content management systems and e-commerce platforms, including WordPress, Drupal, Joomla, and Magento. Dane Knecht, chief technology officer at Cloudflare, noted that early attacks are already emerging, with the company updating firewall rules as a stopgap measure. While security firm watchTowr confirmed the existence of the vulnerabilities, unconfirmed reports suggest the flaws may affect every PHP version from 2004 onward, though this remains under verification as the official patches roll out.
Sources
The WireByte editorial team synthesises technology news from multiple primary sources, verifies the facts, and links every source. Articles are produced with AI assistance and reviewed under our editorial policy.
