Attackers Exploit Leaked PHP Zero-Days as Dutch Cyber Agency Goes Offline

Attackers have begun actively exploiting one or more critical PHP zero-day vulnerabilities in the wild after details of the bugs leaked early on Tuesday, ahead of their scheduled Thursday embargo. The flaws—tracked as CVE-2026-109618 and CVE-2026-109619 and both rated 9.2 on the CVSS v4.0 scale—allow unauthenticated remote attackers to execute arbitrary code and take control of underlying server infrastructure. In response to active exploitation, the Dutch National Cyber Security Centre temporarily took its own website offline as a precaution, while Britain's NCSC advised organizations to immediately patch internet-facing PHP systems once updates arrive or take them offline if immediate remediation isn't feasible. Following the embargo failure, the PHP Foundation moved its security patch release forward from Thursday at 15:00 UTC to Wednesday at 14:00 UTC. While only PHP versions 8.2, 8.3, 8.4, and 8.5 are currently actively supported, cybersecurity firm watchTowr stated the bugs appear to affect PHP versions 5, 6, 7, and 8, and runZero noted unverified reporting indicating versions 5.4.0 and later may be vulnerable. To buy defenders time ahead of the official patch, Cloudflare $NET deployed emergency Web Application Firewall rules across all customer tiers, including its free tier, to block known exploit vectors as they emerge. "We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only. Patch as soon as ThePHPF releases the update." — Dan Knecht, CTO at Cloudflare