US Government Urges Immediate Patching for Critical PHP Vulnerabilities Affecting Widespread Web Infrastructure

The U.S. government is calling for immediate action to patch two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP, a widely used open-source scripting language. These flaws could expose federal agencies and critical infrastructure to cyberattacks. Patches were released by the PHP Foundation, with AI tools reportedly assisting in the rapid identification of a fix for vulnerabilities that had existed for over a decade. Governments in Europe have also taken websites offline as a precautionary measure.