‘This Is Not A Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire
The PHP Foundation has issued emergency security updates to address two critical vulnerabilities affecting all versions of the PHP programming language. Security experts warn that these flaws could lead to widespread exploitation of web infrastructure.
Why it matters
Because PHP powers a significant portion of the internet, including major platforms like WordPress, these vulnerabilities pose a systemic risk to global web security.
Internet security and web administration teams around the world are scrambling to prevent widespread disaster. On Wednesday, the developers behind the much-used PHP programming language released emergency security updates designed to fix critical flaws that could be exploited to allow attackers to gain dangerous remote control of victim systems.
The PHP Foundation detailed the two critical vulnerabilities—CVE-2026-109618 and CVE-2026-109619—which impact “all PHP installations serving web requests” going back to PHP version 5, released in July 2004. However, only PHP 8.2 and newer are still supported and will receive patches, according to the alert. The PHP Foundation noted, though, that some PHP distributions and third-party vendors still produce legacy fixes. The caveat is significant, because ubiquitous and foundational web layers like PHP can persist forgotten and un-updated in historic internet infrastructure.
Headlinne story · 7 newsrooms
Global Websites Go Dark After AI Uncovers Critical Programming Language Flaws
What every outlet reported, where they differ, and how each framed it →
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in