PHP patches two critical RCE flaws affecting web servers as Cloudflare reports early exploit attempts, with no confirmed breaches.

By Rajveer Pardesi and Raphael Satter Oct 21 (Reuters) - The developers of the widely used PHP programming language said on Wednesday they would release patches for two critical vulnerabilities, as EU cybersecurity officials warned organisations unable to apply the fixes should take affected websites offline.

Crucial vulnerabilities in the PHP language is so severe that global authorities have recommended websites temporarily go offline until it can be fixed.

PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 could allow remote code execution, affecting versions back to PHP 5; urgent updates are advised.

Organisations unable to apply key fixes to widely used software should consider taking their websites down, EU cybersecurity officials have warned.

Two vulnerabilities with a severity score of 9.2 (CVSS v4.0, out of 10) have been discovered in PHP.The patched versions are scheduled to be released on October 21st at 11:00 PM JST.If you own a site running on PHP,

Two severe vulnerabilities in PHP can lead to unauthenticated remote code execution, enabling hackers to tamper with websites and servers that use the scripting language.