World
PHP Developers Release Critical Security Patches Following Global Code Vulnerability Scare
Why it matters
The urgent release addresses severe vulnerabilities in a widely used programming language that underpins most of the internet, highlighting growing security risks as automated tools accelerate cyber threats.
The brief
Developers of the PHP programming language released emergency patches on Wednesday to address two critical vulnerabilities discovered in software that powers approximately 70 percent of websites worldwide, DW English reported.[3] DW English stated that the security gaps, tracked as CVE-2026-109618 and CVE-2026-109619, could allow malicious actors to remotely seize control of web servers and bypass password requirements.[4][5] Al Jazeera reported that artificial intelligence models helped independent researchers uncover the flaws, which had remained hidden in the codebase for more than a decade.[6][7] The discovery sparked a worldwide security scramble, with governments and organizations taking official websites offline as a precautionary measure while patches were applied, according to DW English and the Guardian.[8] Cloudflare reported detecting hundreds of thousands of exploit attempts shortly after details leaked prior to the scheduled update, though cybersecurity experts noted that widespread successful attacks have not yet been confirmed.[9][10]
What we don’t know yet
- Artificial intelligence models helped independent researchers uncover the flaws Other sources report this differently; those sources are not identified here.
- The flaws had remained hidden in the codebase for more than a decade Other sources report this differently; those sources are not identified here.
Quick answers
- What happened?
- Developers of the PHP programming language released emergency patches on Wednesday to address two critical vulnerabilities discovered in software that powers approximately 70 percent of websites worldwide, DW English reported. DW English stated that the security gaps, tracked as CVE-2026-109618 and CVE-2026-109619, could allow malicious actors to remotely seize control of web servers and bypass password requirements. Al Jazeera reported that artificial intelligence models helped independent researchers uncover the flaws, which had remained hidden in the codebase for more than a decade. The discovery sparked a worldwide security scramble, with governments and organizations taking official websites offline as a precautionary measure while patches were applied, according to DW English and the Guardian. Cloudflare reported detecting hundreds of thousands of exploit attempts shortly after details leaked prior to the scheduled update, though cybersecurity experts noted that widespread successful attacks have not yet been confirmed.
- Why does it matter?
- The urgent release addresses severe vulnerabilities in a widely used programming language that underpins most of the internet, highlighting growing security risks as automated tools accelerate cyber threats.
- How was "PHP Developers Release Critical Security Patches Following Global Code Vulnerability Scare" verified?
- Citelink grounded this brief in 3 sources, including Guardian Technology, Al Jazeera, DW English. Claims are numbered and listed with their evidence status below; the sources are listed separately.
Grounding — each claim we extracted, checked against sources
PHP Developers Released Critical Security Patches Following Global Code Vulnerability Scare
The urgent release addresses severe vulnerabilities in a widely used programming language that underpins most of the internet
Developers of the PHP programming language released emergency patches on Wednesday to address two critical vulnerabilities discovered in software that powers approximately 70 percent of websites worldwide
The security gaps are tracked as CVE-2026-109618 and CVE-2026-109619
The vulnerabilities could allow malicious actors to remotely seize control of web servers and bypass password requirements
Artificial intelligence models helped independent researchers uncover the flaws
The flaws had remained hidden in the codebase for more than a decade
The discovery sparked a worldwide security scramble, with governments and organizations taking official websites offline as a precautionary measure while patches were applied
Cloudflare reported detecting hundreds of thousands of exploit attempts shortly after details leaked prior to the scheduled update
Widespread successful attacks have not yet been confirmed by cybersecurity experts
Check a claim yourself
Optional: check any claim from this brief yourself with Citelink's verification tool.
Sources
How this brief was made
Citelink’s automated pipeline wrote this summary from the 3 sources listed above, then checked each claim we extracted from the brief against them before publishing. Briefs are not individually reviewed by a person before they go live, so read the original reporting for the full story.
Spotted an error? Request a correction · Corrections policy