India, Oct. 22 -- Two critical vulnerabilities in the PHP programming language have triggered urgent security warnings, with Palo Alto Networks estimating that approximately 22 million internet-facing instances could be exposed. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, carry Common Vulnerability Scoring System (CVSS) 4.0 scores of 9.2 out of 10 and could allow unauthenticated attackers to execute arbitrary code on affected systems.

The vulnerabilities affect PHP, a widely deployed server-side programming language used by websites, content management systems, and web applications. The PHP security team released fixes on October 21, 2026, prompting security agencies and technology providers to advise organisations to iden...