Two Critical PHP Flaws Put Millions of Web Servers at Risk, Patch Now

Palo Alto Networks' Unit 42 has issued a threat brief on two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. Both allow remote code execution (RCE), meaning an attacker could run their own commands on an affected system. Each is rated 9.2 on the CVSS 4.0 scale. PHP is widely used across web servers and content management systems worldwide, so many business websites could be affected.

The risk is not just theoretical. Unit 42 says it has seen proof of concept for these vulnerabilities, and at least one European government has taken its website offline as a precaution. Palo Alto Networks' Cortex Xpanse telemetry has identified more than 22.6 million exposed instances that are potentially vulnerable at the time of publication.

Unit 42 encourages organisations to review the PHP Group's security advisory and patching guidance, assess their exposure, and patch immediately. The brief also describes protections available to Palo Alto Networks customers, including tools that detect vulnerable PHP versions and identify exposed systems on the public internet. Unit 42 notes that its Incident Response team can help organisations that suspect a compromise. This summary is based on the opening of the brief, so check the original and the PHP advisory for full details.