Yeah, this one's real, and it's PHP. Here's the picture:
*What's confirmed:*
- Two vulnerabilities in PHP itself (not a plugin, the core language): *CVE-2026-109618* and *CVE-2026-109619*
- Both are *unauthenticated RCE* â an attacker can run their own code on a web server without any login. That's the worst category of bug there is.
- PHP's security team rates them *9.2 out of 10* (CVSS v4). watchTowr, a legit exploit research firm, says they've already reproduced one of them and confirmed it's real.
- Reportedly affects basically *every PHP version from 5 through 8*, which matters because PHP runs a huge chunk of the internet, WordPress included.
*How it blew up:* the flaws were under embargo, supposed to be revealed Thursday. Details leaked early yesterday, so PHP pulled the emergency patch forward to *today, 14:00 UTC. That's 7:30 PM your time tonight.*
*The hype layer:* a site claiming to have working exploit code is already circulating, and one researcher says he's hearing the bug is already being exploited in the wild. Neither is fully verified yet, and PHP hasn't published the technical details, so nobody knows the exact trigger conditions until tonight.
*Is it severe?* Yes, genuinely. An unauthenticated RCE in something as widespread as PHP is Log4Shell-tier news for the web world. The saving grace is the patch lands within hours, at least for supported versions (8.2+). Old PHP 5 and 7 installs likely get nothing, and there are millions of those still live.
If you run anything PHP-based anywhere, tonight is patch night. And honestly, watching how a disclosure like this unfolds (embargo, leak, emergency release) is great real-world study material for where you're headed.
āļāļāļ§ āļ¸āˇāļāļ¯ āļāļģāļąāˇāļą āļāļąāˇ āļāˇāļēāļŊāļāˇ āļ¯āˇāļ´āļ āļāˇāļ¸āˇāļŊāˇ āˇāˇāļāˇāļŊāˇāļąāˇ
