Critical PHP Vulnerabilities: What UK Organisations Need to Know and Do

Two critical vulnerabilities in PHP — CVE-2026-109618 and CVE-2026-109619 — have been confirmed as actively exploited in the wild, according to threat intelligence published by Palo Alto Networks Unit 42 and corroborated by reporting from Dark Reading and Wired. Both flaws allow unauthenticated remote code execution, meaning an attacker with network access to a vulnerable server can run arbitrary commands without needing valid credentials. PHP is the scripting language that underpins a significant proportion of the world's web infrastructure, including content management systems such as WordPress, Drupal and Joomla, as well as countless custom-built web applications. The breadth of the potential attack surface makes this one of the more significant vulnerability disclosures of the year.

Why this matters for UK organisations

A large number of UK business websites, customer portals, e-commerce platforms and internal web applications are built on PHP. Many of these will be managed by third-party hosting providers or development agencies rather than in-house teams, which can create ambiguity about who is responsible for applying patches and monitoring for exploitation. Wired's reporting highlights a particularly important development: AI tools were used both to help discover these vulnerabilities and to accelerate the creation of working exploits, compressing the time between public disclosure and active exploitation to a degree that makes rapid response more important than ever. Dark Reading notes that remediation is not always straightforward — organisations running older or customised PHP applications may face compatibility issues that require careful testing before patches can be safely deployed, meaning a structured and prioritised approach is needed rather than a blanket update.

What to review

UK organisations should begin by establishing an accurate inventory of any systems running PHP, including externally hosted websites, web applications and CMS platforms. Where PHP is in use, confirm the version and check whether patches addressing these CVEs have been applied. If patching cannot be completed immediately due to compatibility concerns or change management processes, consider whether web application firewall rules can provide interim protection while remediation is planned. Engage your hosting provider, managed service provider or development agency to confirm their response posture. This is also a useful moment to review whether your organisation has a clear and tested process for responding to critical vulnerability disclosures in widely used open-source components — a process that will be needed again as AI continues to accelerate the vulnerability discovery and exploitation cycle.

Source: Palo Alto Networks Unit 42