PHP exploitation moves at slower-than-expected pace, but millions remain at risk

Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619 (reported severity 9.2 each, enabling remote code execution), are drawing exploitation attempts, including from an expanded Potassium botnet variant that Sophos blocked. Wiz compared the potential impact to Heartbleed, but VulnCheck and Mandiant say most public exploits fail, partly because they rely on the rarely used display_errors setting. Mandiant validated some that work against default mod_php, not PHP-FPM. Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, restart services, and rotate exposed credentials.