Ethical Hacking News
The PHP programming language has been hit with two critical vulnerabilities that could have devastating consequences for the internet. The PHP Foundation has released emergency security updates, but experts warn that exploiting these vulnerabilities could happen very fast and at a scale.
The PHP programming language has been hit with two critical vulnerabilities that could allow attackers to gain remote control of affected systems. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, impact all PHP installations serving web requests, dating back to PHP version 5 in 2004. Only PHP 8.2 and newer versions are still supported and will receive patches. Security experts warn that failure to quickly patch these flaws could have dire consequences, with the potential for widespread disaster. The PHP Foundation has released emergency security updates, but experts warn that exploiting these vulnerabilities could happen very fast and at a scale. Organizations and businesses are advised to focus on updating systems using PHP, monitoring for potential exploitation, and applying updates as they become available. The incident highlights the importance of keeping software up-to-date and the need for vigilance in the face of emerging threats.
The PHP programming language, widely used for web development, has been rocked by two critical vulnerabilities that could have devastating consequences for the internet. The PHP Foundation, the organization responsible for maintaining the language, has issued emergency security updates to address the flaws, which could allow attackers to gain remote control of affected systems.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, impact all PHP installations serving web requests, dating back to the release of PHP version 5 in 2004. However, only PHP 8.2 and newer versions are still supported and will receive patches. The PHP Foundation has noted that some PHP distributions and third-party vendors still produce legacy fixes, which could potentially leave systems vulnerable.
Security experts warn that failure to quickly patch these flaws could have dire consequences, with the potential for widespread disaster. Lukasz Olejnik, an independent security consultant and visiting senior research fellow at King's College London, likens the widespread use of PHP to critical infrastructure, stating that "the impact is enormous." He warns that malicious hackers could quickly exploit these vulnerabilities, potentially leading to wormable malware affecting large chunks of the internet.
The PHP Foundation has released emergency security updates to address the flaws, but experts warn that exploiting these vulnerabilities could happen very fast and at a scale. Security company Wiz, which discovered the vulnerabilities partially using AI tools, claims that in some cases, the vulnerabilities can be exploited "fairly easily." The Wiz researchers note that the vulnerabilities can allow unauthenticated attackers to execute code on affected servers or read sensitive process memory, potentially containing passwords, authentication tokens, API keys, and certificates.
The early warning from the PHP Foundation may have given some developers, security teams, and companies enough time to prepare to update their systems using PHP. However, with the potential for widespread exploitation, it is essential for organizations and businesses to take immediate action. The UK's National Cyber Security Center (NCSC) has published an alert, advising organizations to prepare for immediate updating of systems using PHP and to identify systems running PHP across their tech infrastructure.
The NCSC advises that organizations and businesses should focus on systems using PHP that are connected to the internet, monitoring them for any potential exploitation. The next step is applying PHP updates as they become available and monitoring for updates from software companies, as they may use PHP within their apps or services. If a system is compromised, it is essential to isolate the system, preserve web server and PHP logs, and report it to the local FBI field office.
The incident highlights the importance of keeping software up-to-date and the need for vigilance in the face of emerging threats. As the internet continues to evolve, it is essential for organizations and individuals to stay informed and take proactive measures to protect themselves against potential threats.
Related Information:
https://www.ethicalhackingnews.com/articles/The-PHP-Vulnerability-Apocalypse-A-Global-Threat-to-Internet-Security-ehn.shtml
https://www.wired.com/story/this-is-not-a-drill-2-php-vulnerabilities-are-setting-the-internet-on-fire/
https://nvd.nist.gov/vuln/detail/CVE-2026-109618
https://www.cvedetails.com/cve/CVE-2026-109618/
https://nvd.nist.gov/vuln/detail/CVE-2026-109619
https://www.cvedetails.com/cve/CVE-2026-109619/
Published: Wed Oct 21 12:02:47 2026 by llama3.2 3B Q4_K_M
