Two major cybersecurity vulnerabilities have put websites across the internet at risk, including sites built with the popular content management systems WordPress and MediaWiki, as well as many e-commerce platforms.
The vulnerabilities are in PHP, a programming language that powers a huge number of websites and web applications. Security researchers say the flaws could allow hackers to remotely run their own code on a website’s server without first gaining access, possibly giving them control of that website.
Article continues below this ad
Both of the flaws were rated critical, with a score of 9.2 out of 10 under the cybersecurity industry’s standard vulnerability scoring system.
The flaws leaked Tuesday afternoon, ahead of a security patch scheduled to arrive Wednesday morning at 9 a.m. CT.
A video posted online Tuesday appeared to show a possible hacker using the exploit, but as of late Tuesday, there was no evidence the vulnerabilities had been used to target websites at scale.
“We reserve the right to release (the patches) earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild,” PHP security said as it <a href="https://www.php.net/archive/2026.php” rel=”nofollow noopener” target=”_blank”>announced the critical vulnerabilities.
Cybersecurity experts on X, as well as IT news sites like Bleeping Computer, reported Tuesday afternoon the exploits had leaked and hackers were showcasing the vulnerabilities. Cybersecurity companies warned people this was not a joke.
“Take this seriously and apply patches when available,” the cybersecurity company watchTowr said on X.
PHP identified the vulnerabilities—CVE-2026-109618 and CVE-2026-109619—and said it will release more information Wednesday.
What is PHP?
PHP is a very popular server-side programming language that powers websites. For example, if you use WordPress to build a website, WordPress is like the car while PHP is part of the engine. It works in the background to generate the websites people see in their browsers.
Of all the websites whose server-side programming language is known, nearly 7 in 10 use PHP, according to the web technology tracking site W3Techs.
2024 CrowdStrike outage highlighted how web vulnerabilities can disrupt life
Few companies will soon forget the disruptions caused by a faulty software update in July 2024 that grounded flights, disrupted hospitals and even knocked offline some financial companies.
Stay informed, and entertained.
It was caused by the Austin-based cybersecurity firm CrowdStrike.
As the Associated Press reported at the time, “the breadth of the outage highlighted the fragility of a digitized world dependent on just a few providers for key computing services.”
That massive outage was triggered by a CrowdStrike update that impacted Microsoft Windows, crippling the most popular operating system in the world.
TV | KPRC’s Cathy Hernandez returns to the Texans sideline
Lawsuits | Houston developer sued after blind employee fired on first day
Jobs | Texas layoffs hit Benchmark Mortgage, Hello Bello during Thanksgiving
Courts | Houston man’s Pakistani divorce rejected by Texas Supreme Court
For the latest and best from Chron, sign up for our daily newsletter here.
