According to WuShuo, the PHP Foundation announced that the widely used PHP programming language for web development has exposed two critical remote code execution vulnerabilities (CVE-2026-109618, CVE-2026-109619). Both have a CVSS 4.0 score of 9.2, allowing attackers to control affected servers under specific conditions without authentication. The incident caused temporary outages on October 21 for government websites in the Netherlands, France, Germany, Finland, and parts of Wikipedia's services. The PHP Foundation admitted that early signs of one of the vulnerabilities were discovered as far back as 2024, but due to disagreements over technical decisions and a lack of resources in the security team, the fix was delayed for a long time, calling it a "structural failure." In August this year, security company Calif and OpenAI independently reported the same underlying issue, further exposing its remote code execution risks. PHP has urgently released a patched version and is urging website operators to upgrade immediately. https://www.(wublock123.com)/news/php-rce-vulnerabilities-multiple-government-sites-down-70489