PHP releases emergency fixes as some of the world's biggest websites say they were targeted by hackers

PHP released fixes for two critical remote code execution flaws and urged immediate patching Security researchers and Cloudflare reported early exploitation attempts before patches became available Millions of internet-facing PHP installations may be at risk, especially unsupported legacy versions PHP has released patches for two critical remote code execution (RCE) vulnerabilities and “strongly encouraged” all users to apply them as soon as possible, as hackers are starting to abuse the flaws in real-life attacks.

PHP issued a new security advisory saying it addressed CVE-2026-109618 and CVE-2026-109619 with a patch.

The former is an out-of-memory handling bug, while the latter is a use-after-free memory error.

Both were assigned a severity score of 9.2/10 (critical).

The vulnerabilities were addressed in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

Users can download the versions from PHP’s downloads pages, with Windows source and binaries being on the same page.

Linux distributions and LTS vendors received the patches in advance, it was said, so users should check with their vendors for updated packages.

Shaking the internet’s foundations PHP is among the most popular programming languages for websites and web applications in the world, so when remote code execution zero-days are found, it’s a big deal.

PHP was supposed to work on a solution in silence, not to give cybercriminals a head start on exploitation.

However, information about the vulnerabilities leaked on the internet two days in advance, causing serious panic, and according to Reuters multiple government, healthcare, and education websites across Europe decided to temporarily shut down to prevent being targeted.

Different sources made different claims.

For example, Florian Roth, Head of Research at Nextron Systems, said both flaws would be given a 10/10 severity score, which did not happen.

He also said only PHP 8 would be patched, which turned out to be true, despite other sources claiming PHP down to version 5 being fixed.

This, too, is a huge deal, since it’s safe to say that millions of websites are running older, end-of-life PHP versions, and could now be targeted with relative ease.