PHP Foundation

PHP Foundatio

2026-10-22 00:59:07

PHP Foundation says delayed fix for critical flaws was a structural failure

The PHP Foundation said delays in fixing critical security flaws first identified in 2024 stemmed from hesitation in decision-making and a lack of resources, describing the lapse as a "structural failure." PHP, a programming language widely used across websites and web applications, has now issued emergency patches for two related critical vulnerabilities. The flaws could allow unauthenticated attackers to execute code on affected servers without logging in. The issue prompted operational responses in several countries. Some government websites or online services in the Netherlands, Finland, France, Germany and Australia were temporarily taken offline to prepare for patch deployment. Security firm Calif and OpenAI each reported the same underlying issue on Aug. 11, with Calif also demonstrating unconditional remote code execution. In the crypto sector, blockchain security firm SlowMist reviewed PHP exposure and found direct PHP fingerprints on 793 of 1,488 domains it assessed. Intersect temporarily shut its Members Area, while Coinbase said it found no affected PHP instances and digital asset infrastructure company BitGo said its platform was not impacted. Binance co-founder Changpeng Zhao urged users to stay cautious when visiting websites, and OpenAI released a Codex skill to help check vulnerable PHP versions.

80

PHP vulnerabi

2026-10-21 16:43:00

Critical PHP flaws trigger precautionary shutdowns across government and major websites

PHP pushed emergency fixes on Oct. 21 for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS v4.0 and described as unauthenticated remote code execution flaws. The disclosure set off precautionary shutdowns across multiple countries, including the Dutch National Cyber Security Centre, parts of the Dutch and Finnish government web infrastructure, France’s data protection authority CNIL, and Japanese platforms such as pixiv and Niconico. The incident was shaped not only by the severity of the bugs, but also by a compressed disclosure timeline after leaks surfaced ahead of the planned release. Public data cited in the report shows that more than 70% of exposed PHP servers with disclosed version information were running unsupported branches, leaving a large share of systems dependent on distributors or forced shutdowns rather than official upstream patches. Security agencies in the EU, UK, US, Australia, Japan, and France all urged immediate patching or temporary disconnection where upgrades were not possible.

30