This Is Not A Drill': Critical PHP Vulnerabilities Are Setting the Internet on Fire

The PHP Foundation has released emergency security updates to address two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, warning that attackers could gain dangerous remote control of systems. The issues affect “all PHP installations serving web requests” going back to PHP 5, first released in July 2004, though only PHP 8.2 and newer remain supported and will receive patches. The Foundation cautioned there are no complete mitigations and that updating is the only safe choice, noting legacy fixes can persist in third-party distributions. Security teams fear rapid exploitation after Cloudflare reported early attacks emerging before the patches. Sansec said mass attacks could begin within 15 minutes of release.