PHP, used by 70% of websites worldwide, disclosed to have a critical vulnerability, with countries entering a state of emergency

PHP was disclosed to have two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of a maximum of 10, allowing attackers to execute malicious code on servers without logging in or additional authentication. The PHP development team moved the update originally scheduled for the 22nd up to the 21st, releasing fix versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Government portals, school- and hospital-related websites in the Netherlands, Finland, Denmark and Belgium and the European Patent Office had suspended some external services, and CERT-EU, ENISA and Europol called for patching as soon as possible. W3Techs data shows that about 75% of websites with an identifiable server language use PHP. According to foreign media reports, a US cybersecurity company discovered the flaw while analyzing PHP code with OpenAI's GPT-5.6 Sol, and Google's security company Wiz separately discovered and reported it, bringing the more-than-decade-old issue to light.