Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, could allow remote code execution without authentication. Following their disclosure, public agencies, banks and transport services across Europe and Japan temporarily suspended some digital services as a precaution. Cloudflare detected millions of exploitation attempts, although these do not necessarily represent successful intrusions. Fixes were released in PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12, but deployment, security checks and the testing required before services can return to operation may take days or even weeks.
Source: Read the original article
Disclaimer: this content is for information purposes only and is not financial advice. Cryptocurrencies are highly volatile: you may lose all of your capital. Always do your own research. Legal notice
