PHP prepares urgent patches for two critical vulnerabilities affecting its software ecosystem
PHP maintainers said they plan to release emergency patches for two vulnerabilities, each rated 9.2 out of 10, and urged users to be ready to upgrade. The flaws could affect a wide range of websites and applications built with PHP, making rapid patching important.
Details of the vulnerabilities remain unconfirmed publicly. Security firm watchTowr said it had verified the flaws, identified as CVE-2026-109618 and CVE-2026-109619, and said they may affect every PHP version since 5; a separate report claimed a tool could remotely run code on popular PHP-based platforms. Researchers warned attacks could begin soon after the patches appear, while one estimate put the number of potentially affected internet-connected hosts at 1.3 million.
- PHP plans two emergency security patches.
- Both vulnerabilities are rated 9.2 out of 10.
- Admins are urged to prepare for rapid upgrades.
Read the full article at the source →
Originally published by Ars Technica as “PHP warns it plans to release 2 emergency patches imminently”.