Web administrators and security teams across the globe are scrambling to address critical flaws in PHP, a programming language powering much of the internet. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, allow attackers to gain remote control of victim systems, with the PHP 8.2 and newer versions receiving updates. The extensive use of PHP in major web platforms, such as WordPress and Drupal, means millions of systems could be at risk. Security experts, including Lukasz Olejnik from King’s College London, warn that exploiting these vulnerabilities could lead to widespread damage, potentially including wormable malware affecting large portions of the internet.

The urgency is palpable, with security firm Sansec predicting mass attacks within 15 minutes of the release of fixes. Cloudflare reported early attacks, and organizations, including government sites in Finland and the Port of Rotterdam, took their sites offline as a precaution. The vulnerabilities can allow unauthenticated attackers to execute code on affected servers or read sensitive process memory, potentially compromising passwords, authentication tokens, and API keys.

The PHP Foundation provided advance notice, but the early leaks of vulnerability details could have given some organizations a heads-up. Despite the risks, the NCSC advises businesses to identify and update systems running PHP, prioritizing those connected to the internet. As AI plays a bigger role in exploiting these issues, the clock is ticking to secure our digital infrastructure.