"This is not a drill": critical PHP vulnerabilities are plunging the internet into crisis

The PHP Foundation released an emergency security update fixing two critical vulnerabilities with a CVSS score of 9.2, affecting all PHP installations that handle web requests since PHP 5. Vulnerabilities CVE-2026-109618 and CVE-2026-109619 could allow unauthenticated attackers to execute code or read process memory on affected servers, which may contain passwords, tokens, API keys and certificates. Cloudflare said it had seen early attacks before the update was released, Sansec expects large-scale attacks within 15 minutes of the fix's release, and some Finnish and French government websites and the Port of Rotterdam website were taken offline as a precaution. Only PHP 8.2 and newer versions are still supported and receive patches; the Foundation says there is no complete mitigation and updating is the only safe option. Wiz says its researchers found the vulnerabilities partly with the help of AI tools, and OpenAI and security firm Calif also said they independently discovered them and are collaborating, with the demo codenamed php2shell.