Palo Alto Networks has urged organisations to respond to two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, warning that an estimated 22 million PHP instances are exposed worldwide.
Each vulnerability has a CVSS score of 9.2, placing the flaws among the most serious security issues affecting internet-facing systems. Because PHP remains widely used in web infrastructure, the newly disclosed vulnerabilities could have a far larger footprint than several other recent incidents.
Lee Klarich, Chief Product and Technology Officer at Palo Alto Networks, said the issue reflects a broader shift in how software flaws are discovered and exploited. He linked that change to increasingly capable artificial intelligence models, which he said are accelerating cyber operations.
Recent NetScaler vulnerabilities affected about 50,000 potentially exposed instances, while a BeyondTrust flaw tracked as CVE-2026-1731 involved about 16,000, according to Palo Alto Networks. By contrast, the estimated 22 million exposed PHP instances point to a much wider attack surface.
Five priorities
Palo Alto Networks outlined five immediate steps for organisations addressing the PHP flaws. First, assess exposure across open-source software inventories, internal codebases and supply chains to identify vulnerable systems and gaps in visibility.
Second, prioritise remediation by reachability: how accessible affected assets are to attackers and what the likely impact of a successful compromise would be. The aim is to help security teams focus first on the systems posing the most immediate risk.
Third, secure AI tools and infrastructure from the outset rather than treating them as a separate or later-stage problem.
Fourth, supplement traditional patching with virtual patching and other real-time compensating controls while permanent fixes are tested and deployed across production environments.
Fifth, security operations centres need to cut detection and response times sharply as automated attacks reduce the window for containing active threats.
Changing threat pace
Klarich said the vulnerabilities highlight a larger problem for defenders managing widely deployed open-source technologies. Older patching models are no longer enough on their own, he said, as the time between disclosure, reverse engineering and attempted exploitation continues to shrink.
"The vulnerabilities represent a significant shift in the cyberthreat landscape, where increasingly capable AI models are accelerating vulnerability discovery while attackers can reverse engineer newly released patches and target underlying flaws at unprecedented speed," Klarich said.
This reflects a wider debate across the cybersecurity sector over whether software vendors, enterprises and public sector bodies can adapt quickly enough to an environment in which attackers use automation to compress campaign timelines. Security teams have long dealt with patch backlogs, but the concern now is that newly disclosed flaws can be analysed and acted on far faster than many organisations can respond.
The disclosure reinforces the case for moving away from point-in-time security measures towards continuous monitoring and automated defence processes, Palo Alto Networks said. In practice, that means maintaining current software asset inventories, clearer visibility over internet-exposed systems and better prioritisation of the most exploitable weaknesses.
It also said risk-based remediation should sit alongside real-time prevention tools, particularly where widely deployed software creates a large pool of potential targets. For companies running large estates of web applications and services, the PHP issue is likely to raise fresh questions about exposure management and patch discipline.
Klarich said defenders should treat the incident as a test of broader resilience rather than a one-off flaw. "Traditional, manual patching cycles alone are no longer sufficient to address this evolving threat landscape," he said.