CISA Urges Immediate Patching of Critical PHP Flaws

The Cybersecurity and Infrastructure Security Agency (CISA) on Oct. 21 warned organizations about critical vulnerabilities in the widely used PHP programming language that could allow attackers to remotely execute malicious code on vulnerable servers without authentication. Also today, PHP developers released security updates addressing the two vulnerabilities – CVE-2026-109618 and CVE-2026-109619, which each carry a severity score of 9.2 out of 10.