‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire

The PHP Foundation has announced two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that affect all PHP installations since version 5, released in July 2004. However, only PHP 8.2 and newer will receive patches. Many legacy fixes from distributions and third-party vendors still exist. Security experts warn that patching is the only safe option, as there are currently no complete mitigations.

Wired security consultant Lukasz Olejnik likens the widespread use of PHP to critical infrastructure, stating that the impact of these flaws could be enormous, affecting millions of systems. Experts fear malicious hackers could quickly exploit the vulnerabilities, potentially leading to wormable malware impacting a significant portion of the internet.

Before the PHP Foundation released the fixes, Cloudflare reported early attacks emerging, and Sansec expected mass attacks within 15 minutes of the release. Some organizations have taken their websites offline as a precautionary measure. Wiz, an AI-powered security company, discovered the vulnerabilities using AI tools, while OpenAI and Calif independently found the issues.

The vulnerabilities allow unauthenticated attackers to execute code on affected servers or read sensitive process memory, potentially containing passwords, authentication tokens, API keys, and certificates. The PHP Foundation issued an advance warning ahead of the vulnerabilities' official release, and security agencies worldwide advised organizations to prepare for immediate system updates.