Many MindedTwo critical PHP bugs force an emergency patch scramble across the web
On October 21, 2026, the PHP project released an emergency security update for two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. Either lets an attacker run code of their choosing on a vulnerable server. They affect servers running PHP 5.4 or later. Fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Ubuntu has shipped updated packages, and the SANS Internet Storm Center is tracking vendor updates.
The scale is the story. Nearly 70 percent of websites reportedly need to update their core software. PHP sits under Drupal, Magento, Joomla and WordPress. A Censys scan found about 2.58 million internet-facing hosts and 54.9 million web properties running PHP. Wiz says every PHP version released in the past decade is affected by at least one flaw. Cloudflare saw some exploitation and pushed web application firewall rules at 3:02 am UTC. Reuters reported that government websites in Europe and elsewhere went offline after disclosure.
Why it matters for abundance: reliable, safe access to online services is part of what makes information and public services effectively free. A shared component that sits under much of the web turns one defect into a mass patching event. Sites that are slow to update, often small and under-resourced, are the ones most likely to be taken over or knocked out. Wiz says the bugs existed for decades and that frontier AI models lowered the barrier to building a working exploit. If that holds, finding old flaws gets cheaper for attackers as well as defenders.
Watch for confirmation of mass exploitation, which Wiz researchers expect to take the form of web shells for remote control, and for how fast the long tail of sites patches. Caveats: the story was still moving, and claims about active exploitation and working exploits come from quoted experts and companies, not independent verification. The government outages come from Reuters, not Krebs. Krebs notes that Wiz advertises on his blog. Wiz compared the pair to 2021's Log4Shell.
Source: Krebs on Security