PHP vulnerabilities put millions of servers at risk

Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), rated 9.2 out of 10, have put millions of systems at risk. Technical details leaked ahead of the planned disclosure, potentially giving attackers a head start.

According to VirusTotal, approximately 5.1 million IP addresses run PHP, including 758,000 using outdated, unsupported versions. Since PHP powers around 70% of websites with a known server-side language, the potential exposure is significant.

The flaws could allow remote attackers to execute code and gain control of vulnerable servers without authentication. The NSA has advised organizations to take affected systems offline if immediate patching is not possible. France, Finland and the Netherlands have reportedly disconnected some government websites.

PHP released security patches on Wednesday. However, experts warn that updating systems alone may not be enough. Organizations must also investigate whether attackers gained access before the fixes were installed.

Security experts recommend three key steps:

Identify vulnerable systems: Check all PHP deployments, including outdated versions and third-party components;

Install patches immediately: Prioritize internet-facing servers and exposed systems;

Check for breaches: Look for unauthorized access, backdoors and signs of attackers moving through internal networks.

Experts also warn that AI is making vulnerability exploitation faster and more accessible. Attackers can use it to analyze code, develop exploits and reverse-engineer security patches.

Comparing the potential impact to the Heartbleed vulnerability, specialists stress that patching alone is not enough. Organizations should also implement network segmentation, additional security controls and runtime protection to prevent a compromised server from becoming a company-wide breach.