Critical PHP vulnerabilities are confirmed
The PHP Foundation
The Foundation confirms two critical flaws and corrected releases. This supports the existence and seriousness of the vulnerabilities, not the percentage.
Based on: The PHP Foundation
Verdict
Misleading
Verification confidenceHigh
Explanation
The PHP vulnerabilities are real and serious, but “70% of websites” is not a measured vulnerability rate. W3Techs reports PHP usage among websites whose server-side language it can identify; that statistic does not establish how many sites can be compromised.
On October 21, 2026, PHP released fixes for CVE-2026-109618 and CVE-2026-109619. The PHP Foundation confirms that these flaws can allow attackers to execute code without authentication under suitable conditions. Fixed releases include PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
The Canadian Centre for Cyber Security warns of broad exposure across PHP deployments serving web requests. However, a website’s susceptibility depends on its software and deployment conditions. The sources establish widespread risk, not a verified percentage of compromised websites.
Key takeaway
PHP usage, vulnerability and successful compromise are different measurements.
Evidence
Supports the claim
The percentage measures adoption
W3Techs
Its 69.3% figure covers websites with an identifiable server-side language, not a census of vulnerable websites.
Based on: W3Techs
Government alert confirms broad exposure
Canadian Centre for Cyber Security
The alert describes serious risk across PHP web deployments but does not quantify a worldwide vulnerable-site percentage.
Based on: Canadian Centre for Cyber Security
A documented source of the broad framing
Wiz Research
Wiz documents exploitation research and uses the 70% framing. Its report is not a census of compromised websites.
Based on: Wiz
Sources
The PHP Foundation
Today's PHP Security Release, and How We're Strengthening PHP Security
Oct 21, 2026W3Techs
Usage statistics of PHP for websites
Canadian Centre for Cyber Security
Alert - AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619
Oct 21, 2026Wiz
PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
Oct 21, 2026Was this check helpful?
Sign in required
Sign in required
Related checks
Technology
Is it true that Facebook's parent company Meta can use my photos?
Yes, within applicable permissions and policies. Sharing photos gives Meta usage rights, not ownership; public content can also be used for AI training.
Verdict
True
Verification confidenceHigh
Technology
Does Chrome's Incognito mode make you anonymous online?
No. Incognito limits what Chrome saves on your device. Websites and organizations managing your network may still observe your activity.
Verdict
False
Verification confidenceHigh
Technology
Do yellow arrows and circles in YouTube thumbnails increase views?
The specific effect is unverified. Some observational data links thumbnail graphics with stronger performance, but it does not prove that yellow arrows and circles cause more views.
Verdict
Unverified
Verification confidenceMedium