Two critical PHP flaws leak early, and Australian businesses are told to prepare to patch

The maintainers of PHP, the widely used scripting language, have warned users to prepare for patches addressing two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. PHP rates both at 9.2 out of 10 for severity, with fixes expected overnight Australian time. A poster on Hacker News claimed the flaws were remote code execution vulnerabilities, which could let an attacker run their own commands on an affected system.

The news broke before the planned embargo expired. Hours after the vulnerabilities surfaced on social media, a researcher reportedly posted full details online, including two proofs of concept. iTnews has seen the website but has not been able to confirm that the proofs of concept actually work.

The Australian Signals Directorate issued an unusual pre-patch alert, saying the flaws may affect all versions from PHP 5 onwards and urging organisations to monitor their PHP applications and prepare to update. CERT-EU, which serves EU institutions, also advised preparing for immediate patching. Where that is not possible, it suggested considering isolating internet-facing applications from public networks until a fix is available. PHP underpins popular platforms including WordPress, Drupal and Magento, running on millions of sites worldwide. Official technical details and patching advice are still to come.