Two critical flaws in PHP, the software behind most websites including WordPress, can let an attacker take over a web server without logging in. Early attacks have already been seen.

• What it is: Two bugs, tracked as CVE-2026-109618 and CVE-2026-109619, allow remote code execution on servers running PHP.
• Who is affected: Any business website or web application running PHP, including WordPress, Joomla and Drupal sites. Servers on PHP 8.1 or older no longer receive standard updates.
• The risk: An attacker could run their own code on your web server, steal data or use it to attack others.
• Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

We recommend asking your web host or IT provider to confirm your PHP version has been updated this week. If you run an older version, plan an upgrade now. Source: BleepingComputer.