PHP Patches Critical RCE Flaws After Government Sites Go Offline

Two newly disclosed PHP flaws can let attackers run code on affected servers, while related outages took government websites in several countries offline Wednesday, Oct. 21.

The vulnerabilities carry identifiers CVE-2026-109618 and CVE-2026-109619. Both received a 9.2 score on the CVSS 4.0 severity scale and were classified as critical. Under specific conditions, an attacker can exploit them without authentication and take control of an affected server.

Government websites in the Netherlands, France, Germany and Finland, along with some Wikipedia services, were temporarily offline Wednesday, Oct. 21.

The PHP Foundation said developers found early signs of one flaw in 2024, but technical disagreements and limited security-team resources delayed repairs for two years. It called the delay a structural failure. Security company Calif and OpenAI independently identified the same underlying issue in August.

PHP has released fixes and urged website operators to upgrade to patched versions. PHP is widely used in website development.