A pair of critical security flaws in the PHP programming language has been discovered, forcing an emergency patch and sparking scattered attacks across the web.
What happened
Researchers, with the help of AI, found the flaws, which could allow an attacker to remotely take over a server without logging in. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, were rated 9.2 out of 10 on the industry's standard severity scale.
The PHP team released emergency fixes for the vulnerabilities, which affect PHP versions 5 through 8. The UK's National Cyber Security Centre urged organizations to install the fix immediately, advising them to find and update all systems running PHP, especially those that are internet-facing.
Cloudflare reported seeing early attacks and has added emergency firewall rules to block suspicious requests tied to the flaws. The company's protection is available to all customers, including those on free plans.
The responsibility for patching systems falls on website operators and hosting providers, and ordinary people browsing the web do not need to install anything.
