PHP developers have announced that new patches have been released to address critical security vulnerabilities that have recently been disclosed. These patches were made available to the public by the PHP development team on Wednesday.
Importance of the New Patches
These patches are recommended for all PHP users to update promptly. Millions of websites worldwide, including critical infrastructure, government portals, news sites, and online stores, rely on PHP. This free software is maintained by volunteers.
Read more: European media companies call for a halt to new Meta conditions
The new patches are designed to address two critical vulnerabilities that hackers could exploit to remotely control websites and servers, easily bypassing common barriers such as protected accounts. These vulnerabilities have been identified as CVE-2026-109618 and CVE-2026-109619.
Potential Consequences
By exploiting these vulnerabilities, malicious actors could gain access to government databases and customer information, alter websites, or jeopardize online businesses and services. Two security companies, Calif and Wiz, identified these vulnerabilities in August and used AI tools to discover PHP issues.
While working on fixing this issue, PHP developers kept information about it confidential. However, news of these vulnerabilities was disclosed on Tuesday, one day before the scheduled update.
Hours before the PHP update was released, Dain Kent, Chief Technology Officer of the security company Cloudflare, announced that hackers were attempting to exploit these vulnerabilities. He said, "We are seeing initial attacks and are updating our protective measures."
Officials in several countries, including Australia, Japan, and several European countries, issued warnings and shut down government websites to prevent potential attacks. In France, the Paris police website was temporarily taken offline due to the identification of a critical security vulnerability. Additionally, Germany's government IT services suspended some websites using PHP. Belgium's Ministry of Foreign Affairs temporarily disabled its online presence, and the Netherlands Cybersecurity Agency also went online as a precautionary measure.
The U.S. National Security Agency (NSA) warned that these vulnerabilities "often provide a direct path to the server's file system or database." They recommended: "If an immediate update is not possible, it is better for organizations to take the system offline until the issue is fully resolved."
Meanwhile, the White House announced that it became aware of this issue last week and that U.S. federal agencies are assessing the potential impact on government systems and infrastructure.
Read more: Governments take control of political discussions using concerns related to artificial intelligence · Alexandria Ocasio-Cortez and Robert Garcia received a suspicious letter
