PHP fixes two critical vulnerabilities as websites face attack risks
Developers of the PHP programming language have released security updates to fix two critical vulnerabilities, urging users to update immediately as website operators work to protect their systems. Government websites in Europe and elsewhere went offline on Wednesday following the disclosure of the vulnerabilities which reported that website operators were scrambling to secure their systems,…
Security updates have been released by PHP developers to address two critical vulnerabilities that could expose websites to attack risks. PHP, a server-side scripting language, underpins large portions of the internet and is used to build websites and web applications. A warning from the US National Security Agency Cybersecurity suggests that affected systems might provide unauthorized access to a server's file system or database.
Both vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, were rated highly critical with a score of 9.2 under the Common Vulnerability Scoring System (CVSS v4). They involve memory corruption under certain conditions and could allow attackers to execute code without proper authentication. The PHP Foundation announced that the security updates would be released at 14:00 UTC on October 21, 2026.
Users are encouraged to prepare for the update, as a possible earlier release could occur in response to a demonstrated exploit or active evidence of exploitation. The PHP security team noted that mod_php, a configuration facing the highest risk, has demonstrated an exploit that could affect an unauthenticated request before application code runs.
Written by urgent.news from Gulf News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
