Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, first drew attention in August after an AI review, causing widespread disruption.
The vulnerability or weakness
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-109618 | 9.2 | CRITICAL | No | - |
| CVE-2026-109619 | 9.2 | CRITICAL | No | - |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
No earlier related attack in our archive yet.
Business impact
Hundreds of websites were taken offline, impacting businesses and governments. The vulnerabilities could lead to remote code execution and denial-of-service attacks.
Industries affected
The incident affects a wide range of industries, including e-commerce, finance, and government services, given the prevalence of PHP in web applications.
