From PC World: If you’re of a certain age, “PHP” may invoke memories of early web development in the 1990s. In the decades since, the scripting language has hummed along in the background, used by popular platforms like WordPress. But just this week, it suddenly got an enormous spotlight as the internet lit up with alarm over two high-risk vulnerabilities.
If you’re not a server administrator, you may be wondering what the danger really is. In fact, if the admins for the websites you use or run were quick enough, you may have not noticed a thing.
On October 20, 2026, the PHP Group (which maintains PHP) released an alert for coming security updates, designed to patch two very high-risk vulnerabilities later named as CVE-2026-109618 and CVE-2026-109619. Both enable an attacker to run remote code, carry a severity rating of 9.2 of 10, and affect “all PHP installations serving web requests,” according to the PHP Group.
The advisory set off a flurry across the web, with server administrators hurriedly preparing for the patched versions of PHP. When details of the two vulnerabilities released the next day on October 21, sites across the web began going offline temporarily as PHP upgrades were completed—including government websites in the Netherlands, France, and Germany.
View: Full Article
