Critical PHP Vulnerabilities Disclosed, Affecting Millions of Web Instances Globally

Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP, a widely used programming language, have been publicly disclosed. These flaws, each with a CVSS score of 9.2, pose a significant risk to web applications and government websites worldwide, with an estimated 22 million PHP instances exposed. Organizations like AWS are releasing updates, and cybersecurity agencies are urging immediate patching due to the potential for rapid exploitation.