Key facts
- Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were patched on October 21.
- The flaws allow unauthenticated remote code execution and are rated 9.2 out of 10.
- PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 received official fixes.
- Governments in Finland, the Netherlands, and France took websites offline as a precaution.
- Attacks were reported hours before the security patch was released.
Two critical vulnerabilities in the PHP programming language, identified by cybersecurity researchers using OpenAI's GPT-5.6 Sol model, have put an estimated 70% of the world's websites at risk. The flaws, CVE-2026-109618 and CVE-2026-109619, were patched on October 21, with an official release at 13:35 UTC. These vulnerabilities are rated 9.2 out of 10 and allow for unauthenticated remote code execution, meaning attackers could exploit them to steal data or modify websites.
PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 received official fixes, while older versions may receive backported patches. The PHP Foundation and the PHP security team had raised alarms and provided advance notice of the upcoming security release. Governments in Finland, the Netherlands, and France took their websites offline as a precautionary measure. Cloudflare reported that early attacks were emerging and that they were updating mitigations as new vectors appeared. Japanese Prime Minister Sanae Takaichi issued an urgent request for immediate action.