PHP-OCALYPSE: HOW TWO CRITICAL WEB BUGS ALMOST BROKE THE INTERNET

Summary from the TLDR InfoSec newsletter

Two PHP flaws, CVE-2026-109618 and CVE-2026-109619, enable unauthenticated remote code execution on unpatched servers. The PHP Foundation released fixes on October 21, and banks, retailers, hospitals, and government services briefly took systems offline to install them. Amazon detected exploitation about a week before disclosure, and Palo Alto Networks and Trail of Bits later confirmed compromises. Cloudflare reported a sharp rise in exploitation attempts after disclosure. PHP powers roughly 70% of web-facing sites, including WordPress, Drupal, Joomla, and MediaWiki.