Security researchers at Calif discovered two critical bugs in the PHP programming language, designated as CVE-2026-109618 and CVE-2026-109619, which allow unauthenticated remote code execution. The PHP Foundation released patches on Wednesday after a coordinated disclosure period, prompting millions of systems to update to prevent unauthorized access. Amazon detected exploitation attempts a week before the official patch release, indicating that some attackers had early knowledge of the flaws. Although many organizations temporarily took their websites offline to mitigate risks, security experts warn that unpatched systems remain vulnerable to data theft and malware installation.
Read the full story at techcrunch.com.
Photo: Pexels / Pixabay
