Critical PHP flaws put millions of websites at risk as governments pull sites offline

Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) with a severity rating of 9.2 have prompted emergency patches and led governments, including the FBI and NSA, to advise taking vulnerable websites offline to prevent exploitation. The flaws threaten millions of websites globally, as PHP underpins nearly 70% of websites with a known server-side language.

This Wire brief sits within Fusion42's coverage of Enterprise Software, Cybersecurity and Security Infrastructure, and 16 sources have reported it between 21 Oct 2026 and 22 Oct 2026.