Critical PHP vulnerabilities put 22 Million exposed instances at risk

Two critical vulnerabilities in the PHP programming language have triggered urgent security warnings, with Palo Alto Networks estimating that approximately 22 million internet-facing instances could be exposed. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, carry Common Vulnerability Scoring System (CVSS) 4.0 scores of 9.2 out of 10 and could allow unauthenticated attackers to execute arbitrary code on affected systems. The vulnerabilities affect PHP , a widely deployed server-side p