CONNECT WITH US
Tech

Tech

‘This Is Not A Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire

Wired logo

Published on

Add as a preferred source on Google
‘This Is Not A Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire

Internet security and web administration teams around the world are scrambling to prevent widespread disaster. On Wednesday, the developers behind the much-used PHP programming language released emergency security updates designed to fix critical flaws that could be exploited to allow attackers to gain dangerous remote control of victim systems.

The PHP Foundation detailed the two critical vulnerabilities—CVE-2026-109618 and CVE-2026-109619—which impact “all PHP installations serving web requests” going back to PHP version 5, released in July 2004. However, only PHP 8.2 and newer are still supported and will receive patches, according to the alert. The PHP Foundation noted, though, that some PHP distributions and third-party vendors still produce legacy fixes. The caveat is significant, because ubiquitous and foundational web layers like PHP can persist forgotten and un-updated in historic internet infrastructure.

“There are no complete mitigations, updating is the only safe choice,” the PHP Foundation wrote in its advisories. Security experts warn of the potential dire consequences of overlooking unpatched systems.

“This is not a drill,” says Lukasz Olejnik, an independent security consultant and visiting senior research fellow at King’s College London. Since its development in the 1990s, PHP has evolved into an essential scripting language for web development and is used across vast swaths of the internet in websites and software. Everything from publishing systems like WordPress and Drupal to e-commerce platforms like Adobe’s Magento are built on PHP.

Olejnik likens the widespread use of the programming language to critical infrastructure.

“The impact is enormous,” he says of PHP’s security flaws, adding that millions of systems could be impacted.


Source link
Related Topics:Tech

Disclaimer

We strive to uphold the highest ethical standards in all of our reporting and coverage. We TheMorningPulse.fyi want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It's possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.