Published 38 minutes ago • loading... • Updated 26 minutes ago
AI Just Found a Bug That Puts Up to 70% of the World’s Websites at Risk
Security officials said the flaws could allow unauthenticated remote code execution and affect versions dating back to PHP 5, with more than 1.3 million hosts at risk.
On Wednesday, October 21, 2026, the PHP security team released emergency patches for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, urging administrators to upgrade immediately.
Following online leaks and reproduction by watchTowr, the PHP Foundation accelerated the release; both vulnerabilities carry a 9.2 severity rating on the CVSS v4.0 scale.
Cloudflare chief technology officer Dane Knecht reported "seeing early attacks emerging," while CERT-EU and the Australian Cyber Security Centre advised organizations to isolate internet-facing applications if immediate patching was not feasible.
Government websites in the Netherlands and Finland went offline as a precaution, as operators scrambled to secure infrastructure amid the disclosure of critical vulnerabilities in the widely used programming language.
Updating remains the only safe choice, as no workaround fully addresses the flaws, and automatic updates for WordPress will not apply these critical security fixes, requiring manual intervention.
Websites belonging to government agencies around Europe were shut down as a result of a vulnerability on Wednesday. In Norway, too, more have been affected.