Global Security Warning: Critical Vulnerabilities Threaten Website Servers

The PHP development team announced the discovery of two critical security vulnerabilities that allow attackers to take control of website servers and execute malicious code remotely. The team issued urgent security updates on October 21, and the Singapore Cybersecurity Agency classified the vulnerabilities with a severity score of 9.2 out of 10.

The PHP development team announced the discovery of two critical security vulnerabilities that could allow attackers to take control of website servers and execute malicious code remotely, without needing to log in. The team issued urgent security updates on October 21, 2026 to address the vulnerabilities, which affect the PHP runtime environment widely used in website and application development. The Singapore Cybersecurity Agency classified the vulnerabilities as critical security risks, giving them a severity score of 9.2 out of 10 according to the fourth version of the Common Vulnerability Scoring System. The vulnerabilities are known as "PHP Two Shell" and carry the security identifiers "CVE-2026-109618" and "CVE-2026-109619". Under certain operating conditions, the vulnerabilities allow an attacker to send malicious requests to the server and exploit a memory management flaw to execute code, even before the website begins processing the request through the application. Their severity stems from their connection to fundamental mechanisms in the PHP runtime itself, not from errors that website developers might make when writing applications.