Critical PHP flaws trigger global website outages as hackers exploit RCE bugs
PHP released emergency patches for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, rated 9.2/10. Millions of global websites, including government portals and Wikimedia, experienced outages while applying fixes. Early exploitation by hackers forced organizations to take sites offline. The update affects PHP versions 8.2 through 8.5, with legacy versions remaining at higher risk.
Key points
- PHP, a widely used programming language for web applications, released patches for two critical remote code execution flaws identified as CVE-2026-109618 and CVE-2026-109619.
- The vulnerabilities, involving out-of-memory handling and use-after-free errors, were assigned a severity score of 9.2/10 and fixed in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
- Cloudflare and security researchers reported early exploitation attempts before patches were widely available, prompting millions of internet-facing installations to update immediately.
- Major outages affected Scottish and Dutch government websites, a Danish school communication platform, and Wikimedia, as organizations took sites offline to apply the fixes.
- Linux distributions and long-term support vendors received the patches in advance, while Windows users were directed to PHP’s official download pages for binaries.
- Unsupported legacy versions of PHP remain particularly vulnerable, posing a continued risk for organizations that have not yet migrated to the latest supported releases.
PHP has released emergency patches for two critical remote code execution vulnerabilities that have caused widespread disruptions across the global web. The security advisory addresses CVE-2026-109618, an out-of-memory handling bug, and CVE-2026-109619, a use-after-free memory error. Both flaws were assigned a severity score of 9.2/10, prompting the PHP team to strongly encourage immediate patching for all users. The fixes are available in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
The urgency of the update was driven by early exploitation attempts reported by Cloudflare and security researchers before the patches were fully distributed. Because PHP underpins a significant portion of the world’s websites, the discovery of zero-day flaws created a high-stakes environment for developers. Many organizations opted to take individual pages or entire websites offline to apply the updates safely, resulting in temporary outages for users. Notable affected sites included government portals in Scotland and the Netherlands, a Danish IT firm’s school communication platform, and Wikimedia’s content store, though most have since returned online.
For system administrators, the rollout process varies by operating system. Linux distributions and long-term support vendors received the patches in advance, requiring users to check with their specific vendors for updated packages. Windows users can download the necessary source and binaries directly from PHP’s official downloads page. While the immediate crisis has been mitigated for supported versions, millions of installations running unsupported legacy versions remain at heightened risk, highlighting the ongoing challenge of maintaining secure web infrastructure globally.
Sources
The WireByte editorial team synthesises technology news from multiple primary sources, verifies the facts, and links every source. Articles are produced with AI assistance and reviewed under our editorial policy.
