Technology and Scienceupdated 1h ago3 min read
Ministry of Digital Transformation Urges Immediate PHP Updates After CVE-2026-109618, CVE-2026-109619
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 require immediate PHP updates. Global government and corporate systems paused or limited services as patches rolled out.
Save coverage image
Explore source coverage 6 source types
Directory totals describe our source library, not outlets checked for this story.
33 outlets told this the same way.
Outlets did split on Marco Rubio Says Elon Musk Controls Ukraine Starlink And Starshield Access →
PHP patch rush
The Ministry of Digital Transformation urged all organizations, both public and private, to immediately update their PHP versions after it detected multiple critical vulnerabilities that could allow remote code execution. INCIBE said the PHP security team reported two severe flaws that prompted an urgent security update, and it urged entities to implement the corresponding mitigations. The PHP Foundation and the National Institute of Cybersecurity tied the issue to CVE-2026-109618 and CVE-2026-109619, which the sources described as critical with a severity rating of 9.2 out of 10 on the CVSS 4.0 scale.
The NCSC warned that the security issue could allow an attacker to trigger an out-of-memory (OOM) condition in PHP that results in memory corruption, and under certain conditions that corruption could be exploited to achieve unauthenticated remote code execution. The NCSC also recommended that if organizations could not apply the temporary mitigations, or applying them would take too long, they should consider taking the system offline until it could be fully mitigated.
Governments take sites down
The FBI’s cyber division warned that the vulnerabilities could allow malicious actors to remotely execute code in PHP, which powers websites and web applications, raising the risk of sensitive data and networks being compromised. The UK’s prime minister’s office said some “limited” government services may temporarily be offline while work was carried out to address potential cybersecurity issues, and it said “No large public-facing critical services are being affected by the exercise.” BBC reporting said Downing Street told Parliament that “32 Government services are unavailable and four are partially unavailable,” attributing the disruption to precautionary measures taken to protect systems while security updates and mitigations were applied.
The BBC also quoted NCSC chief technology officer Olly Whitehouse calling the event “unprecedented,” while he said there were “no indications” of any successful breaches by hackers. The NCSC advised UK organizations to identify systems running PHP across their infrastructure, prioritising internet-facing systems, and to update to the latest version of PHP while continuing to monitor for future updates.
AI discovery, fast exploitation
OpenAI said it led a coalition of researchers, security providers and others to address vulnerabilities in PHP over the past two months, and it called the flaws “one of the most impactful security issues in recent memory.” The BBC said researchers warned the “severe” flaws could expose millions of sites using it to potential hacks if left unpatched, and it reported that websites around the world were taken offline on Wednesday and Thursday after developers of PHP said “critical vulnerabilities” were found. Cloudflare reported that in the 10 hours before the public announcement it observed thousands of attempts to exploit the issue across its network, and the figure rose to tens of thousands in the 45 minutes after the announcement, to hundreds of thousands within 2 hours, and now counts in the millions.
“OpenAI called the flaws ‘one of the most impactful security issues in recent memory.’”
The NCSC said the full PHP security advisory provides more details regarding the fixed security issue, and it said it would continue to monitor for any impact on UK organizations. The NCSC also emphasized that organizations using older versions of PHP were highly encouraged to update to a fully supported version, and it said it would monitor for future updates while operators followed vendor best practice advice in the mitigation of vulnerabilities.