PHP says AI review of critical bugs first sparked alarm in August, but signs surfaced in 2024

Key Points:

• Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have raised alarms due to their widespread impact on web applications, affecting over 70% of websites globally.
• The vulnerabilities allow potential denial-of-service attacks and pose risks of remote code execution, leading to significant downtime for hundreds of websites after emergency patches were issued.
• Immediate actions include applying patches to PHP versions 8.2 and above, while organizations should assess their PHP installations and upgrade outdated versions to mitigate risks.

Technical Details: CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP that have been linked to potential denial-of-service attacks and remote code execution. The issues were exacerbated by a lack of timely action following initial discovery in 2024.

MITRE ATT&CK Techniques: None mentioned

IOCs Mentioned:

• CVE-2026-109618
• CVE-2026-109619
• 5.1 million IP addresses identified as running PHP
• 758,000 IP addresses using end-of-life PHP versions
• 85,000 IP addresses running the latest PHP releases before patches