PHP Foundation warns of two critical vulnerabilities affecting 70% of websites
PHP released emergency versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21 to fix CVE-2026-109618 and CVE-2026-109619, two flaws rated 9.2 out of 10 that allow unauthenticated remote code execution. Finland, the Netherlands, and France took government websites offline as a precaution after details leaked early and Cloudflare reported attacks hours before the fix shipped. Regular users have nothing to install; the fix falls on website owners and hosting companies, and PHP 8.1 and older get no official release.
Two critical PHP vulnerabilities rated 9.2 on the CVSS scale allow unauthenticated remote code execution, putting approximately 70% of all websites at risk. Readers should note that the responsibility for updating lies with website owners and hosting providers, not individual users, and that government actions in Finland, the Netherlands, and France underscore the severity of the threat.
Source: Decrypt · decrypt.co