PHP fixes two critical flaws amid exploitation attempts

The PHP project released emergency fixes on October 21 for two critical vulnerabilities that can let attackers run code on affected web servers without logging in, prompting precautionary outages across UK government services and a surge in reported exploitation attempts. The flaws, identified as CVE-2026-109618 and CVE-2026-109619, each received a CVSS v4 severity score of 9.2. One involves memory corruption during out-of-memory handling; the other involves use of stale data retained between requests. The PHP project’s advisories say both can enable unauthenticated remote code execution, giving an attacker the ability to run code with a web worker’s privileges. Baroness Lloyd of Effra told the House of Lords that 32 government services were unavailable and four partially unavailable. She said the outages had largely resulted from precautionary measures while updates and other mitigations were applied. Downing Street said no large public-facing critical services were affected and stressed that a service being offline did not mean it had been hacked. Cloudflare chief executive Matthew Prince reported thousands of attempted exploits on the company’s network in the 10 hours...