Two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) have been published, both rated CVSS 9.2. Because PHP runs, by some estimates, more than half of all websites, the scale is unprecedented: according to Palo Alto Networks, around 22 million potentially vulnerable PHP instances are exposed to the internet.
For comparison, recent NetScaler vulnerabilities had around 50,000 exposed instances and CVE-2026-1731 in BeyondTrust about 16,000. Pervasive open-source software puts exposure on a different order of magnitude.
Why this is not just another disclosure
Palo Alto Networks describes this as one of the first major examples of how frontier AI models are changing cybersecurity. The latest models find vulnerabilities in code at an extraordinary pace, and as soon as a patch is released, attackers can reverse-engineer it, find the root flaw and start exploiting it in near real time.
The conclusion is simple: patching every system by hand cannot keep pace with exploitation. Real-time protection layers such as virtual patching become essential alongside traditional patching.
Five steps to take now
1. Assess your open-source inventory
You cannot prioritise without knowing where PHP runs and which instances face the internet. You cannot protect what you cannot see. Attack surface management such as Cortex Xpanse finds assets the organisation does not know about, from the outside in, as an attacker would.
2. Prioritise remediation by reachability
You cannot patch everything at once. Instances that are internet-facing and on an attack path come first. Exposure management tools help determine which PHP instances carry the most immediate risk and automate remediation.
3. Secure your AI deployments
While not the focus of these PHP vulnerabilities, the rapid spread of AI across organisations expands the attack surface. Every AI deployment must be a secure AI deployment; see our Prisma AIRS page.
4. Block exploits while you patch
While you coordinate patching with development teams, make sure protections that block real exploit attempts are in place. According to Palo Alto Networks, the new Frontier Virtual Patching capability delivered coverage for these PHP vulnerabilities ahead of public disclosure, and Advanced Threat Prevention on NGFWs and Prisma Access protects against their exploitation.
5. Move to real-time security operations
Autonomous, AI-driven attacks compress the attack lifecycle to minutes. SOC teams need single-digit mean time to detect (MTTD) and respond (MTTR). Cortex XSIAM is built for that shift.
A lasting defensive reflex
This is not a one-off. As frontier AI shrinks the patch-to-exploit window to minutes, assessing exposure, prioritising by reachability and enabling immediate protections must become a continuous, automated motion.
Albisec can check that Advanced Threat Prevention profiles are configured correctly in your Palo Alto Networks environment and help you inventory your internet-facing PHP assets. Contact us or open a support ticket.
Source: Palo Alto Networks Blog, “Millions of PHP Instances Exposed – What Organizations Need To Do Right Now”, Lee Klarich, 21 October 2026. Image: Palo Alto Networks. See the Unit 42 Threat Brief for technical details.
