Critical PHP Flaws Trigger Security Warnings
Two critical vulnerabilities in PHP, a programming language widely used to power websites and web applications, have prompted urgent warnings to organisations worldwide. The flaws, identified as CVE-2026-109618 and CVE-2026-109619, can allow attackers to execute code remotely without authentication. CERT-EU says emergency fixes were released on October 21. Organisations should therefore move beyond preparing for an update and apply the available security patches immediately.
Japan PM Urges Website Checks
Japanese Prime Minister Sanae Takaichi urged organisations to determine whether their public-facing websites use PHP and prepare to install emergency fixes Her warning also advised considering temporary website suspension when prompt patching was not possible. The message highlighted the importance of checking the technology behind public services, business websites and other online platforms rather than assuming hosting arrangements automatically provide protection.
FBI And NSA Warn Of Server Risks
The FBI warned that the vulnerabilities could expose sensitive data and networks through remote code execution. It advised organisations to prepare immediate updates and consider taking affected systems offline if they could not secure them promptly.
The supplied article also cites an NSA warning urging similar precautions. Separately, CERT-EU describes the weaknesses as involving memory corruption and stale internal state. A vulnerable server could be exposed even before an application’s own code runs. Temporary shutdowns should not automatically be interpreted as evidence that a website has been breached. Taking a service offline can be a precaution while administrators install and verify fixes.
PHP Security Updates Available Now
The patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Administrators using distribution-managed packages should check their vendor’s security guidance, since fixes may be supplied through updated packages. CERT-EU recommends isolating affected internet-facing applications when immediate patching is impossible. It also cautions that temporary configuration changes address only certain attack paths; an update is required to fully fix the vulnerabilities. Website owners should contact their hosting provider or technical team to confirm that every affected PHP installation has received the appropriate fix. Where suspicious activity is detected, administrators should preserve relevant logs and follow their incident-response procedures.
