Get Quartz in your inbox

Free daily briefing on global business news.

AI-discovered PHP security flaws prompt global scramble to patch websites

CISA told organizations to take unpatched PHP systems offline as some Wikipedia and 4chan services went down

Yui Mok - PA Images / Getty Images

The PHP project released patches on Wednesday for two critical vulnerabilities that can allow unauthenticated remote code execution, sending organizations scrambling to update their systems or take websites offline.

The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, the project said. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. PHP said all installations serving web requests are at risk, with the highest risk for those running Apache with mod_php. PHP underpins roughly 70% of sites worldwide.

The Cybersecurity and........

© Quartz