PHP Patches Critical RCE Flaws After Government Sites Go Offline
Photo: TokenPost
Two newly disclosed PHP flaws can let attackers run code on affected servers, while related outages took government websites in several countries offline Wednesday, Oct. 21. The vulnerabilities carry identifiers CVE-2026-109618 and CVE-2026-109619. Both received a 9.2 score on the CVSS 4.0 severity scale and were classified as critical. Under specific conditions, an attacker can exploit them without authentication and take control of an affected server. Government websites in the Netherlands, France, Germany and Finland, along with some Wikipedia services, were temporarily offline Wednesday, Oct. 21.
Source: TokenPost
