KISA urges urgent PHP updates over critical remote code execution flaws
The Korea Internet & Security Agency has issued an urgent warning regarding critical remote code execution vulnerabilities in the PHP programming language. These flaws allow attackers to take control of servers without authentication, affecting a vast majority of websites globally.
Why it matters
Because PHP powers roughly 75% of the web, including WordPress, these vulnerabilities pose a massive risk to global internet security.
Attackers can reportedly exploit the vulnerabilities to remotely run arbitrary code or take control of affected systems without requiring login credentials or authentication.
An illustration of a hacker using a laptop SHUTTERSTOCK Critical security vulnerabilities that could allow hackers to take control of websites without authentication have been discovered in PHP, a programming language widely used by websites around the world, with the Korea Internet & Security Agency (KISA) calling for immediate security updates.
One vulnerability, known as CVE-2026-109618, involves the improper handling of unexpected errors, while the other, known as CVE-2026-109619, occurs when a program attempts to access memory that has already been released.
The vulnerabilities affect PHP versions 8.2, 8.3, 8.4 and 8.5, and systems running versions earlier than PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 may also be vulnerable to attacks. KISA urged internet users to update their PHP installations to the corresponding patched versions or later releases.
Headlinne story · 7 newsrooms
Global Websites Go Dark After AI Uncovers Critical Programming Language Flaws
What every outlet reported, where they differ, and how each framed it →
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in