PHP vulnerabilities trigger emergency global cybersecurity mobilization
Two critical vulnerabilities affecting the PHP programming language have triggered an emergency global mobilization among cybersecurity authorities and major technology firms. The flaws—designated CVE-2026-109618 and CVE-2026-109619—carry a severity score of 9.2 out of 10.
Governments Order Urgent Security Patches for PHP Systems
Governments across the United States, the United Kingdom, Canada, Australia, Singapore, and the European Union issued urgent directives instructing organizations to locate affected systems and apply security patches immediately. The cybersecurity firm Wiz estimated the immense footprint of PHP across the internet, amplifying the potential exposure for databases, files, and sensitive enterprise information. British authorities issued a drastic recommendation: vulnerable systems incapable of immediate updates should be disconnected from the internet entirely until fixes are installed.
Cloudflare Deploys Firewall Protections to Block Malicious Requests
To stem the immediate risk, Cloudflare deployed specific firewall protections designed to block malicious requests aimed at unpatched web applications while administrators scramble to deploy software updates.
Amazon Detects Suspicious Activity Before Public Disclosure
Amazon detected suspicious activity through its MadPot internet infrastructure threat-detection system before the vulnerabilities were publicly disclosed. Yet a central question remains open: Amazon noted that it is still unclear how attackers acquired knowledge of the flaws prior to public notification.
Artificial Intelligence in Vulnerability Hunt and Defense
In response to the crisis, Google utilized artificial intelligence models through its Wiz division to locate and investigate the vulnerabilities. Gemini assisted specifically in attack simulations and patch verification. Meanwhile, OpenAI stated that researchers working alongside its models also contributed to identifying critical PHP flaws, coordinating with developers and security vendors over the past two months to prepare defenses before public disclosure.