news-tldr.com

The important facts, the open questions, and the sources — without the churn.

← Latest briefing

Technology

PHP issues emergency patches for two critical flaws affecting websites worldwide

Agencies including the UK NCSC and US NSA urged organisations to patch or take systems offline as security firms report early attacks.

Updated Oct 22, 2026 · 12:14 UTC28 reports

The short version

  • PHP released emergency updates on 21 October fixing two critical flaws, CVE-2026-109618 and CVE-2026-109619.[Wired · BBC News · Hacker News]
  • The flaws reportedly reach all PHP installations back to PHP 5, but only PHP 8.2 and newer receive official patches.[Slashdot · Wired]
  • Agencies including the UK NCSC and US NSA urged organisations to patch or take systems offline if they cannot update.[BBC News]
  • Cloudflare, watchTowr and Patchstack report early or active exploitation, while Wiz's 70 percent internet estimate is unverified.[Wired · BBC News · NBC News · CNET]

Key facts

  • PHP released updates on 21 October 2026 addressing CVE-2026-109618 and CVE-2026-109619.[Wired · BBC News · Hacker News]
  • The flaws reportedly affect all PHP installations serving web requests back to PHP 5, released in 2004.[Slashdot · Wired]
  • Only PHP 8.2 and newer remain supported and will receive official patches.[Wired]
  • OpenAI said hacker team Calif found the flaws using its GPT-5.6 Sol model, and Wiz says it independently identified them.[CNET]
  • Cloudflare's chief technology officer said the company was seeing early attacks and updating mitigations.[BBC News · NBC News]
  • watchTowr said it is observing in-the-wild exploitation, and Patchstack said it received reports of active exploitation.[NBC News · CNET]
  • The UK NCSC, EU and Australian counterparts urged organisations to apply the fixes, and the US NSA advised taking systems offline if they could not update.[BBC News]

What remains uncertain

  • Wiz's estimate that roughly 70 percent of the internet is affected is its own figure, which the BBC says it cannot verify.[BBC News]
  • Versions older than PHP 8.2 get no official patch, so their remaining exposure is unresolved in the reporting.[Wired]
  • The extent of exploitation is unclear; the reports cited come from security firms and give no count of affected systems.[NBC News · CNET]

Sources

Outlet counts describe coverage, not independent confirmation. Reports may share a wire service or original source.