Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, rated 9.2 out of 10, could affect about 70 percent of websites, Kaspersky reported on its official blog on Nov. 3, 2026. Citing Censys figures reported there, of 46 million scannable servers running a vulnerable PHP version, 29 million still contain the flaws, GreyNoise counted 1,177 successful attacks on its honeypots by Nov. 3, and the Canadian Centre for Cyber Security has issued alert AL26-026.
Two weeks is a long exposure window for a critical flaw with active attacks. The unpatched count is not a mystery problem. It is an inventory problem: many organizations do not know every site, test server and forgotten application still running PHP in their environment.
Attackers do not need your main website. An overlooked one will do.
Patching is only half the job. Because attacks are already succeeding, teams should also check for signs of compromise on exposed servers before assuming a patch closes the incident. That emergency patching and checking is core managed IT patching work, and it should run to a list, server by server, not to memory.
Today, inventory every server and site running PHP, patch the vulnerable versions, then check the exposed systems for compromise and record the result for each one. A server nobody owns is the server most likely to still be vulnerable tonight.