PHP releases emergency fixes for two critical vulnerabilities

PHP released emergency fixes Wednesday for two critical vulnerabilities that could let attackers run code on affected web servers without logging in, prompting organizations in several countries to patch systems or temporarily take services offline. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, each received a 9.2 rating on the CVSS v4.0 severity scale. PHP’s security team said updating is necessary to protect affected installations. The vulnerabilities are in PHP’s runtime, so updating a website’s application alone does not install the fixes. PHP published patched releases for versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The project also provided source backports for PHP 7.4, 8.0 and 8.1. Operators using older or unsupported installations may need vendor-provided backports or to migrate to a supported branch. Some public-facing services were taken offline as a precaution while operators waited for fixes or applied them. Government services in the Netherlands, Finland and France were among those reported to have suspended access. Other organizations also disconnected services, though the full extent of outages was not established. Cloudflare Chief Technology...