Two critical flaws in PHP's core trigger cybersecurity alerts worldwide
INCIBE warned about two severe remote code execution vulnerabilities in PHP's core, identified as CVE-2026-109618 and CVE-2026-109619 and rated critical at 9.2 out of 10. The flaws allow cybercriminals to force servers to run their own programs by saturating memory or reusing stale data. As a precaution, Wikimedia and the Dutch cybersecurity agency temporarily shut down their portals. Cloudflare reported more than one million cyberattacks after the official notice.
In 30 seconds
- Two critical vulnerabilities in PHP's core, rated 9.2 out of 10, allow remote code execution
- PHP is used by nearly 70% of websites, so the impact is large-scale
- Wikimedia and the Dutch cybersecurity agency temporarily shut down their portals
IASummary generated by artificial intelligence from a story by Atresmedia. It may contain errors: the original source prevails.




Comments
Be respectful. Comments reported by several people are hidden until a moderator reviews them.
You do not need an account to read, only to comment. Sign in with a code sent to your email or with your Google account. We only show the name you choose, never your email.