Two critical vulnerabilities in PHP, a scripting language used by the majority of websites, prompted urgent warnings from cybersecurity officials and government agencies worldwide. The flaws, identified as CVE-2026-109618 and CVE-2026-109619, carry severity scores of 9.2 out of 10. PHP maintainers released patches and encouraged users to upgrade immediately. Multiple governments, including those of the European Union, Germany, Japan, Australia, the United Kingdom, and the Netherlands, issued alerts about the vulnerabilities, with some preemptively taking websites offline.
Security experts reported that attackers were already exploiting the vulnerabilities in active attacks. Major companies including Nintendo took services offline to address the issues. However, significant concerns remain about the millions of websites running outdated PHP versions that cannot receive updates. Security researchers warn that older systems, often forgotten or unmonitored, present substantial risks since attackers can develop functional exploits rapidly using artificial intelligence, potentially creating a wave of exploitation after patches become widely available.
Source: Read the full story at The Record
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
