PHP developers released emergency updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which can enable unauthenticated remote code execution. The patches, versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, address flaws affecting all PHP installations that handle web requests, including those using PHP-FPM, Apache's mod_php, php-cgi, FrankenPHP, and LiteSpeed. Developers emphasized the highest risk for mod_php, where an unauthenticated request could trigger exploitation before application code runs.

CERT-EU issued an advisory urging immediate patching or temporary isolation of internet-facing applications, citing CVSS scores of 9.2 for both vulnerabilities. As a precaution, Finnish government services, Dutch parliamentary websites, and privacy campaign group noyb temporarily took their sites offline. The advisory highlighted the widespread use of PHP across content management systems like WordPress and Drupal, as well as shared hosting platforms, making vulnerability identification complex.

Jake Knott, head of threat intelligence at watchTowr, noted ongoing exploitation attempts observed in the wild, with proof-of-concept code already circulating. John Hammond, senior principal security researcher at Huntress, stated that locating vulnerable PHP installations requires extensive scanning across numerous systems. The incident underscores the pervasive role of PHP in web infrastructure and the urgency of coordinated patching efforts.