Government Warns of Active Attacks Exploiting Two Serious PHP Website Flaws; Agencies Have Three Days to Fix

Attackers are actively exploiting two serious flaws in PHP, a tool used to build websites, the U.S. cybersecurity agency confirmed. The flaws, CVE-2026-109618 and CVE-2026-109619, let outsiders take control remotely without passwords, like a lock that opens without a key. Federal civilian agencies must fix their systems within three days, less than a week after PHP patches came out.