WIDESPREAD PHP FLAW MAY CAUSE MANY SITE OUTAGES TODAY

Summary from the TLDR InfoSec newsletter

PHP released emergency fixes for two exploited zero-days, CVE-2026-109618 and CVE-2026-109619. They enable remote code execution, denial of service, and data exposure on servers running PHP 5.4 or later. Government sites reportedly went offline. Cloudflare has deployed WAF rules. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Patch exposed servers now and watch for web-shell deployment.