Technology
Decade-old PHP flaws force an emergency patch across the web
PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October to fix two critical memory-safety bugs in its core engine that allow unauthenticated remote code execution, tracked as CVE-2026-109618 and CVE-2026-109619. Wiz Research, which found the flaws with its Atlas agent plus Gemini 4 Argon and GPT-5.6 Sol, said every release going back to 5.4 is affected and that severity reaches CVSS 9.2, in a language it says powers about 70% of websites. The NSA advised sites that cannot patch immediately to go offline. Researchers reported no exploitation before disclosure.