PHP flaws trigger global patching effort as researchers warn of exploitation risk

Two severe vulnerabilities disclosed in PHP, identified as CVE-2026-109618 and CVE-2026-109619, prompted governments, companies and website operators to patch systems or temporarily take services offline. Researchers rated the flaws 9.2 out of 10 and warned that attackers could use them to control servers and access data, while no successful exploitation had been reported in the supplied account. AI tools helped researchers locate the long-standing bugs, underscoring their potential to accelerate both vulnerability discovery and offensive development.












