Two severe vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, enable unauthenticated remote code execution across versions dating back to PHP 5.4.

Researchers discovered the flaws using AI models, and patches have been released for PHP 8.2 and up.

According to cybersecurity firm Wiz Security, the problematic piece of code has been in the language for more than a decade and is one of the most serious issues ever identified in software history. The US National Security Agency (NSA) has suggested that organizations take their systems offline if an immediate update is not possible, while the European Union's CERT-EU has recommended isolating applications that face the internet.

Who is affected and what is the scale of the problem?

The problem affects a very large percentage of the internet, as PHP is estimated to run on about 24 million websites, or almost 70% of all known websites. Users include Wikipedia and WordPress.…