The PHP development team has released urgent security patches to address two critical vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. These flaws, which carry a CVSS 4.0 severity score of 9.2 out of 10, allow attackers to execute arbitrary code remotely on affected servers.
The fixes are included in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. While older branches like 8.1 no longer receive standard updates, the team has provided specific patches for some of them. Users are advised to update their systems immediately, as temporary mitigation measures do not guarantee full protection.
The discovery of one vulnerability involved the use of the GPT-5.6 Sol model under the Patch the Planet initiative. OpenAI collaborated with security experts to identify the flaw and prepare defenses. Reports indicate that tens of thousands of websites in the Russian segment of the internet may be at risk.
In Europe, several organizations, including government entities, temporarily took their websites offline as a precautionary measure. There have also been reports regarding a tool named PHP2Shell, which allegedly exploits popular content management systems and web frameworks to execute arbitrary code.
