A major cybersecurity warning has put the internetβs underlying infrastructure under scrutiny after researchers identified two critical vulnerabilities in PHP, a programming language widely used to power websites, online stores, publishing platforms and government services.
According to the PHP development team, the flaws could allow attackers to execute malicious code remotely without authentication, potentially taking control of vulnerable servers and exposing sensitive information.
PHP is used by approximately 70% of websites whose server-side programming language is known, according to technology usage statistics. This widespread adoption means that vulnerabilities in its core software can have far-reaching consequences. However, not every website using PHP is necessarily exposed, and the figure does not mean that 70% of websites have been hacked.
The two security flaws, identified as CVE-2026-109618 and CVE-2026-109619, affect PHPβs handling of memory and internal request data. Under certain conditions, attackers could exploit these weaknesses to run unauthorised code on vulnerable systems.
Potential consequences include:
This article is based on public security advisories and reporting from the sources listed above. It is intended for news and public-awareness purposes and does not claim ownership of the original reporting. The number of potentially affected systems is not the same as the number of confirmed compromises, and the security situation may evolve as organisations apply patches and investigate activity. This article does not necessarily represent our views or endorsements.
ποΈ Audio Disclaimer: All episodes are voiced by Souha. The audio is not AI-generated and features real human narration.
π§ Thank you for listening to our news podcast.
","author_name":"Daily SumUp"}