PHP fixes two critical flaws as agencies urge urgent patching

The PHP project released fixes for two critical vulnerabilities that can allow unauthenticated attackers to execute code on affected servers, prompting security agencies to urge operators to patch or isolate their systems. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each received a severity rating of 9.2 out of 10. The project addressed them in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Its advisory said all PHP installations handling web requests could be at risk. PHP 8.1 and older branches are end-of-life and do not receive project updates. The National Security Agency advised organizations to update immediately or take affected systems offline until they can be mitigated. The FBI also urged operators to update, prioritize internet-facing servers and monitor services for suspicious activity. The UK’s National Cyber Security Centre issued similar guidance. In Britain, a minister said 32 government services were offline and four were partially unavailable during security work. Downing Street said the outages did not mean the services had been hacked, and described the work as precautionary. Some Scottish councils and health boards also temporarily took...