Internet Alert: Two Critical PHP Bugs Put 70% of Websites at Risk

A major security scare just hit the internet. Two serious flaws were found in PHP — a programming language that quietly runs about 70% of all websites whose server-side software is known. If you browsed any website today, you likely used PHP without knowing it.

What is PHP? It's the software working behind the scenes on a website's server (the computer that stores a site and builds each page you ask for). Every WordPress site, for example, runs on PHP. These two new bugs let a stranger run their own commands on that server without ever logging in — security experts call this "unauthenticated remote code execution," which basically means someone else can take control.

Here are the key facts:

• PHP released fixed versions (8.5.12, 8.4.27, 8.3.36, and 8.2.35) on October 21.
• The two bugs (named CVE-2026-109618 and CVE-2026-109619) scored 9.2 out of 10 on a danger scale — "critical" territory.
• Finland, the Netherlands, and France took government websites offline as a safety measure.
• The NSA (a US government cyber agency) urged all organizations using PHP to shut down their sites.
• Older versions (PHP 8.1 and below) get no official fix.

Why the panic? Details about the bugs leaked early, and Cloudflare (an internet security company) reported real attacks starting *hours before* the fix was even released. If a hacked server stores your account details, address, or order history, attackers could steal all of it, deface the website, or take over entirely.

The good news for regular users: You don't need to install anything. The responsibility falls on website owners and hosting companies to update their servers quickly.

Bottom line: A fix exists, but releasing it and getting every website to actually apply it are two very different things. Until most sites update, the risk remains real — so expect continued caution across the web.

This is an AI-generated summary. Read the original article at: https://decrypt.co/381519/php-panic-critical-bugs-70-percent-internet-risk-everyone-freaking-out