Skip to content
Back to the daily read

Daily Read: Tech

PHP Issues Urgent Patches for Critical Server Vulnerabilities

PHP developers have issued emergency security patches to resolve two critical remote code execution flaws that attackers are actively exploiting. The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, stem from memory handling errors and carry critical severity scores of 9.2 out of 10. Official updates were released across supported branches covering PHP 8.2 through 8.5. Details regarding the flaws leaked online two days before the scheduled disclosure, prompting several European public sector websites to shut down preemptively. Millions of public servers remain exposed, with cybersecurity specialists warning that deployments using older, unsupported software face heightened threats. Cloudflare confirmed that malicious actors had already initiated exploitation attempts prior to the patch release. Maintainers strongly urged administrators to update their installations immediately to prevent unauthenticated server takeovers. While minimal backports were provided for legacy branches, engineers recommended tightening request limits and container isolation for systems unable to upgrade right away.

· TechRadar

The essential points

  1. 01Maintainers delivered emergency updates across four PHP branches to remediate two high-severity remote code execution bugs.
  2. 02Hackers began launching active exploitation campaigns shortly after vulnerability details leaked online ahead of schedule.
  3. 03Public sector websites in Europe went offline preemptively to shield infrastructure against potential intrusion attempts.
  4. 04Security teams warn that millions of internet-facing installations on unsupported versions face severe compromise risks.
The full brief

PHP developers have issued emergency security patches to resolve two critical remote code execution flaws that attackers are actively exploiting. The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, stem from memory handling errors and carry critical severity scores of 9.2 out of 10. Official updates were released across supported branches covering PHP 8.2 through 8.5.

Details regarding the flaws leaked online two days before the scheduled disclosure, prompting several European public sector websites to shut down preemptively. Millions of public servers remain exposed, with cybersecurity specialists warning that deployments using older, unsupported software face heightened threats. Cloudflare confirmed that malicious actors had already initiated exploitation attempts prior to the patch release.

Maintainers strongly urged administrators to update their installations immediately to prevent unauthenticated server takeovers. While minimal backports were provided for legacy branches, engineers recommended tightening request limits and container isolation for systems unable to upgrade right away.