EFF Urges More Funding for Open Source Security After PHP Outage Crisis
EFF calls for increased funding in open source security after major PHP vulnerabilities caused internet outages.
Why it matters: Open source software powers much of the web and legal tech infrastructure. Vulnerabilities like these pose systemic risks, making security investment critical to prevent widespread disruptions and data breaches.
- Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affected 70% of websites globally on October 21, 2026.
- Vulnerabilities allowed remote code execution, risking server control and sensitive data exposure.
- PHP Foundation released patches for versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12, but did not patch older versions like 8.1 and earlier.
- EFF called for increased funding to secure open source software following widespread outages as organizations applied emergency patches.
On October 21, 2026, two severe vulnerabilities in the PHP programming language, CVE-2026-109618 and CVE-2026-109619, were publicly disclosed, impacting an estimated 70% of websites worldwide. These flaws, rated 9.2 out of 10 on the CVSS severity scale, allowed attackers to remotely execute code on affected servers, risking full control over those systems and access to sensitive information. OpenAI's GPT-5.6 Sol model played a notable role in accelerating the identification of these vulnerabilities, blending AI-assisted discovery with cybersecurity efforts.
The PHP Foundation responded rapidly, releasing patched versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to plug the security holes. However, older versions like 8.1 and earlier did not receive official fixes, leaving many websites still vulnerable. In the meantime, organizations took their sites offline to apply emergency updates, leading to widespread internet outages globally. Millions of exploitation attempts were observed, with Cloudflare CEO Matthew Prince remarking, "We saw thousands of attempts to exploit it."
The Electronic Frontier Foundation (EFF) used this incident to stress the urgent need for increased funding in open source software security. In a recent statement, the EFF highlighted that open source underpins much of the internet's and legal sectors' infrastructure, and such vulnerabilities present systemic risks that demand collective industry attention and investment. Their call for funding follows broader concerns about the sustainability of open source projects critical to global digital infrastructure.
By the numbers:
- 70% — Approximate percentage of websites impacted by PHP vulnerabilities.
- 9.2/10 — Severity rating of the disclosed CVE-2026-109618 and CVE-2026-109619 vulnerabilities.
- 4 — Number of PHP patched versions released to address flaws (8.2.35, 8.3.36, 8.4.27, 8.5.12).
Yes, but: While patches were quickly released, the absence of fixes for older PHP versions leaves a significant portion of the internet exposed to ongoing risk.
What's next: The PHP Foundation and industry stakeholders are expected to consider longer-term strategies for funding and maintaining security across all PHP versions, including older releases.