Companies and governments are racing to patch two critical vulnerabilities in PHP, one of the web’s most widely deployed programming technologies, after attackers began rapidly targeting exposed systems following public disclosure.
Reuters reported that Cloudflare observed attack traffic rise from thousands of exploitation attempts into the millions after details of the vulnerabilities became public.
The PHP project has now released emergency fixes and says all PHP installations serving web requests should update immediately.
Two flaws can lead to remote code execution
The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619.
The European Union Agency for Cybersecurity, ENISA, said both flaws could allow an attacker to remotely execute malicious code on vulnerable servers without authentication.
Google Cloud said each vulnerability received a critical CVSS severity score of 9.2, and identified PHP versions from 5.4 through 8.5.11 as vulnerable.
Fixed releases include PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older branches such as PHP 8.1 are no longer receiving upstream fixes, meaning systems still using those versions must upgrade to a supported release rather than simply install a patch.
The vulnerability reaches far beyond obvious PHP applications
The scale of the response reflects PHP’s unusual position in web infrastructure.
Cloudflare says PHP is used by almost 70% of websites and underpins widely deployed software including platforms such as WordPress and Magento.
ENISA warned that organisations may also be exposed through commercial or open-source products that contain PHP in the background, even when administrators do not think of their systems as PHP applications.
That makes asset discovery almost as important as patching.
Security teams first have to determine where the vulnerable runtime exists—including inside appliances, containers and third-party products—before they can know whether remediation is complete.
Defenders were racing attackers before disclosure finished
Cloudflare said it had deployed web-application firewall protections about nine hours before the vulnerabilities were publicly disclosed. The company also said information about the flaws leaked before the planned release and that attackers began modifying payloads in attempts to evade protections.
Its mitigation required more than inspecting incoming requests. Cloudflare developed what it calls full transaction detection, combining information from requests with responses to determine whether suspicious activity represented a successful exploit.
National cybersecurity agencies took an unusually aggressive position.
The U.S. National Security Agency advised organisations that could not immediately update to consider taking affected systems offline until mitigation was complete.
Foundational software creates systemic security risk
The incident illustrates why vulnerabilities in languages, runtimes and libraries create a different engineering problem from flaws in individual applications.
PHP sits beneath an enormous number of services. Updating a WordPress plugin, application repository or website template does not fix a vulnerability in the underlying runtime.
The patch race therefore depends on developers, cloud providers, hosting companies, governments and organisations moving together.
For engineering teams, the lesson is larger than PHP.
Modern software stacks contain layers that may remain invisible until something goes wrong. When one of those foundational components fails, the security question rapidly changes from “Is our application vulnerable?” to “Where in our infrastructure is this technology running at all?”
