Security· ★★★★· bearish·

NSA tells unpatched websites to go offline over two critical PHP flaws

  • —The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2
  • —PHP powers roughly 70% of websites, or more than 33 million by some counts
  • —Exploitation could give attackers access to server file systems and databases
  • —Bloomberg reported the flaws were exploited before disclosure, exposing 22.6 million instances
Why it matters: A patch exists, but millions of sites and services must update to PHP 8.5.12 quickly, leaving a window for mass exploitation.
Source: TokenPost
More on this
Security · yesterday
CZ Warns Crypto Users as Critical PHP Flaws Threaten Websites
 Security · yesterday
North Korean sites go dark as PHP flaw triggers global panic
 Security · yesterday
PHP flaws force European government sites and Rotterdam port offline