--- title: Widespread PHP Flaw May Cause Many Site Outages Today description: Two critical PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, can allow an attacker to execute code of their choosing on a vulnerable... canonical: https://daily.dev/posts/widespread-php-flaw-may-cause-many-site-outages-today-fhngiegn9 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Widespread PHP Flaw May Cause Many Site Outages Today | daily.dev og:description: Two critical PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, can allow an attacker to execute code of their choosing on a vulnerable... og:url: https://daily.dev/posts/widespread-php-flaw-may-cause-many-site-outages-today-fhngiegn9 og:image: https://api.daily.dev/og/posts/FHNGIEGn9.png og:image:alt: Widespread PHP Flaw May Cause Many Site Outages Today og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Widespread PHP Flaw May Cause Many Site Outages Today **[Krebs on Security](https://daily.dev/sources/krebsonsecurity)** · 3 min read · 0 upvotes · 0 comments ## Summary Two critical PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, can allow an attacker to execute code of their choosing on a vulnerable server. They affect all web servers running PHP 5.4 or later, and the source says Wiz found every PHP version released in the last decade is affected by at least one of them. Sites built on Drupal, Magento, Joomla and WordPress run on PHP. PHP shipped an emergency fix in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Cloudflare said it has detected some exploitation and at 3:02 am UTC implemented web application firewall rules, and Reuters reports government websites in Europe and elsewhere went offline after the disclosure. Wiz researchers, who worked with OpenAI on coordinated disclosure, say frontier AI models substantially reduced the barrier to turning the decades-old flaw into an exploit, and compare the impact to Log4Shell. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What PHP versions fix CVE-2026-109618 and CVE-2026-109619? The fixes are in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. These two critical vulnerabilities affect every web server running PHP 5.4 or later and allow an attacker to execute arbitrary code on a vulnerable server. Security researchers say every PHP version released in the last decade is affected by at least one of the two bugs. _Teams patching PHP today can track emergency advisories like this one through daily.dev._ ### How were the new PHP RCE vulnerabilities discovered and who found them? Researchers at Wiz, working with OpenAI, the PHP team, and other organizations, found and coordinated disclosure of the flaws. Wiz says demonstrating exploitability required an exceptionally complex chain of steps that had been at the edge of what human researchers could achieve, and that frontier AI models substantially reduced that barrier, turning a longstanding flaw into a working exploit. _Developers watching how AI changes vulnerability research can follow cases like this on daily.dev._ ### How does the new PHP vulnerability compare to Log4Shell in severity? Wiz researchers compare the PHP vulnerability pair directly to Log4Shell, the 2021 flaw in the Log4j Java logging framework, because PHP is so deeply embedded in web applications that organizations are likely to struggle patching it for a long time. PHP runs across clouds, hosting providers, CDNs, and millions of independently managed servers, making coordinated mitigation difficult before public disclosure. _Anyone sizing up a new CVE against past incidents like Log4Shell can keep track of the comparisons on daily.dev._ ## Similar posts on daily.dev - [Websites offline. The internet is on fire. Obviously, we were unprepared.](https://daily.dev/posts/websites-offline-the-internet-is-on-fire-obviously-we-were-unprepared--hv1iepv7z) · Medium · 0 upvotes · 0 comments - [PHP rushes out emergency patches for two critical bugs AI found first](https://daily.dev/posts/php-rushes-out-emergency-patches-for-two-critical-bugs-ai-found-first-smuf7gcab) · The Next Web · 0 upvotes · 0 comments - [A 14-Year-Old PHP Bug Lets Strangers Run Code on Your Server. Here's How to Stop It](https://daily.dev/posts/a-14-year-old-php-bug-lets-strangers-run-code-on-your-server-here-s-how-to-stop-it-vd0nya50m) · Medium · 2 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#php](https://daily.dev/tags/php), [#wordpress](https://daily.dev/tags/wordpress) [View this post on daily.dev](https://daily.dev/posts/widespread-php-flaw-may-cause-many-site-outages-today-fhngiegn9) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Widespread PHP Flaw May Cause Many Site Outages Today","url":"https://daily.dev/posts/widespread-php-flaw-may-cause-many-site-outages-today-fhngiegn9","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/widespread-php-flaw-may-cause-many-site-outages-today-fhngiegn9"},"datePublished":"2026-10-21T15:33:41.367Z","dateModified":"2026-10-21T16:21:15.890Z","description":"Two critical PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, can allow an attacker to execute code of their choosing on a vulnerable...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/321427aa47d9cf8b370406cd7fcdd4a8?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/321427aa47d9cf8b370406cd7fcdd4a8?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Krebs on Security","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Krebs on Security","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/deb3e417ddef4d0e8cc4d704becf6004","url":"https://daily.dev/sources/krebsonsecurity"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/widespread-php-flaw-may-cause-many-site-outages-today-fhngiegn9","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,php,wordpress","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Krebs on Security","item":"https://daily.dev/sources/krebsonsecurity"},{"@type":"ListItem","position":3,"name":"Widespread PHP Flaw May Cause Many Site Outages Today"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/widespread-php-flaw-may-cause-many-site-outages-today-fhngiegn9#faq","mainEntity":[{"@type":"Question","name":"What PHP versions fix CVE-2026-109618 and CVE-2026-109619?","acceptedAnswer":{"@type":"Answer","text":"The fixes are in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. These two critical vulnerabilities affect every web server running PHP 5.4 or later and allow an attacker to execute arbitrary code on a vulnerable server. Security researchers say every PHP version released in the last decade is affected by at least one of the two bugs. Teams patching PHP today can track emergency advisories like this one through daily.dev."}},{"@type":"Question","name":"How were the new PHP RCE vulnerabilities discovered and who found them?","acceptedAnswer":{"@type":"Answer","text":"Researchers at Wiz, working with OpenAI, the PHP team, and other organizations, found and coordinated disclosure of the flaws. Wiz says demonstrating exploitability required an exceptionally complex chain of steps that had been at the edge of what human researchers could achieve, and that frontier AI models substantially reduced that barrier, turning a longstanding flaw into a working exploit. Developers watching how AI changes vulnerability research can follow cases like this on daily.dev."}},{"@type":"Question","name":"How does the new PHP vulnerability compare to Log4Shell in severity?","acceptedAnswer":{"@type":"Answer","text":"Wiz researchers compare the PHP vulnerability pair directly to Log4Shell, the 2021 flaw in the Log4j Java logging framework, because PHP is so deeply embedded in web applications that organizations are likely to struggle patching it for a long time. PHP runs across clouds, hosting providers, CDNs, and millions of independently managed servers, making coordinated mitigation difficult before public disclosure. Anyone sizing up a new CVE against past incidents like Log4Shell can keep track of the comparisons on daily.dev."}}]} ```