PHP Panic: Two Critical Bugs Put 70% of the Internet at Risk, and Everyone Is Freaking Out
Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP, affecting approximately 70% of websites, allow unauthenticated remote code execution. Patches were released on October 21, 2026, but attacks were observed before the fix, leading some governments to take websites offline as a precaution.
- Protocols
- PHP
- Confidence
- High
- First seen
- 21 Oct 2026, 16:18 UTC