Critical Vulnerabilities in Widely Used PHP Software Lead to Global Website Shutdowns and Exploitation Attempts

Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in the PHP programming language, which underpins over 70% of the internet, have been disclosed, prompting urgent security updates and temporary shutdowns of government websites across Europe and other regions. Cybersecurity firms, with the aid of AI tools, discovered these flaws, which had reportedly gone undetected for over a decade. Cloudflare reported millions of exploitation attempts within hours of the public disclosure, and the US government has urged immediate fixes. AWS has also released updated PHP platform versions to address these CVEs, with a targeted upgrade to PHP 8.3.36 for October 22, 2026.