Follow Beinsure
Governments and cybersecurity agencies worldwide have issued urgent warnings over two critical security vulnerabilities in PHP, the programming language underlying a substantial proportion of websites and online applications.
The discovery has prompted emergency software updates, temporary website shutdowns and concerns that attackers could exploit the flaws to gain access to servers.
- Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, could allow unauthenticated remote code execution and compromise web servers.
- Governments, cybersecurity agencies and major online services have responded with emergency patches, temporary shutdowns and warnings about potential attacks.
- Researchers at Calif and Wiz used OpenAI technology to identify flaws that reportedly remained undetected for more than a decade, raising concerns about AI-assisted vulnerability discovery.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could allow attackers to execute malicious code remotely without authentication under certain conditions. The PHP development team released security fixes on Wednesday, October 21, 2026, following a coordinated response involving researchers, technology companies and government agencies.
Authorities in the US, UK, European Union, Australia and Japan have advised organisations to identify affected systems and apply updates immediately. Where fixes or temporary protections cannot be implemented quickly enough, cybersecurity agencies have recommended considering taking vulnerable systems offline.
Several public institutions and online services have already experienced disruption.
Finland temporarily shut down government public web services, leaving parts of its official websites unavailable. Visitors were informed that government websites were experiencing temporary disruption and could be fully or partially inaccessible while the issue was addressed.
In the Netherlands, the national cybersecurity agency announced plans to take its own website offline. The National Institute for Public Health and the Environment, another Dutch government agency, also disabled its website, while the website of the Tweede Kamer, the lower house of parliament, became inaccessible.
The US Federal Bureau of Investigation (FBI) and National Security Agency (NSA) issued warnings about the vulnerabilities, with the FBI’s cyber division cautioning that attackers could remotely execute code and potentially compromise sensitive information and networks.
These vulnerabilities often provide a direct path to the server’s file system or database. NSA recommended that organisations unable to install the security updates immediately consider taking affected systems offline.
The White House said federal agencies were working with leading artificial intelligence laboratories to accelerate the response.
Japan’s Prime Minister Sanae Takaichi also urged organisations and individuals to check whether their publicly accessible websites use PHP.
The Wikimedia Foundation, which operates Wikipedia, confirmed that it was addressing the vulnerabilities and had temporarily disabled several systems as a precaution.
Edinburgh council’s website and pages associated with several BBC programmes, including Doctor Who and The Traitors, also became inaccessible. Neither organisation had confirmed whether those disruptions were connected to the PHP vulnerabilities, and BBC News had approached them for comment.
Other services, including the online art platform DeviantArt, reported temporary maintenance-related outages without identifying the security flaws as the cause.
AI researchers discover critical PHP security flaws
The vulnerabilities were identified by cybersecurity researchers at Calif and Wiz using advanced artificial intelligence technology developed by OpenAI.
According to the companies, the underlying flaws had remained undetected for more than a decade.
Wiz described them as the “most severe vulnerabilities ever discovered” using AI, reflecting the seriousness of the technical findings and the ability of advanced models to identify exploitable weaknesses in established software.
Frontier models were critical to making this process practical, enabling us to develop and adapt working exploits across multiple applications in hours.
The company estimated that “roughly 70%” of the internet could be affected, although BBC News said it could not independently verify that figure.
PHP is widely used to operate websites, content management systems and commercial applications. Its extensive deployment means that vulnerabilities in the language can potentially affect many services beyond websites explicitly identified as using PHP.
OpenAI described the discovery as “one of the most impactful security issues in recent memory”.
In a blog post, the company said it had led a coalition of researchers, security providers and other participants over the preceding two months to coordinate the response.
PHP’s maintainers led the fixes and release, with our teams and partners like Wiz, Cloudflare, and others contributing research, technical support, and coordination to prepare protections ahead of disclosure.
OpenAI
The response combined vulnerability research, software maintenance and protective measures intended to reduce exposure before details became public.
The discovery also illustrates the growing capabilities of AI-assisted cybersecurity research. Advanced models helped researchers identify longstanding weaknesses and develop working exploits across multiple applications within hours, according to Wiz.
How the PHP vulnerabilities could compromise servers
PHP, or PHP Hypertext Preprocessor, is a server-side scripting language used to generate dynamic web content, interact with databases and execute application logic before delivering HTML pages to users’ browsers.
The language also operates within software products, hosting environments and applications where its presence may not be immediately apparent to the organisations responsible for those systems.
Cybersecurity company Huntress warned about the difficulty of identifying every affected deployment.
PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn’t even advertise that it runs PHP under the hood.
The UK National Cyber Security Centre (NCSC) explained that the flaws involve memory-management weaknesses that can arise when PHP encounters an out-of-memory (OOM) condition.
Under certain circumstances, memory corruption resulting from those conditions could permit unauthenticated remote code execution.
The first vulnerability, CVE-2026-109618, concerns the handling of out-of-memory conditions when internal request data has not been fully initialised.
PHP may interrupt processing while that data remains partially initialised. Subsequent request-cleanup operations can then mistakenly treat invalid internal data as legitimate, creating conditions that could be exploited.
The second vulnerability, CVE-2026-109619, involves internal state associated with a request remaining accessible after the memory supporting it has been released.
A later request handled by the same server worker may encounter this stale information before the normal initialisation process resets it.
Both weaknesses can compromise memory handling and, under the necessary conditions, provide a route to executing attacker-controlled code.
The European Union Computer Emergency Response Team (CERT-EU) said the vulnerabilities’ risk scores “indicate the potential for unauthenticated remote code execution”.
Successful exploitation could allow an attacker to install malware, access sensitive systems or disrupt website operations.
The PHP Foundation, whose work includes supporting developers involved in maintaining and securing the language, confirmed that fixes and update instructions had been released.
Authorities warn that attacks may already be emerging
Cybersecurity specialists have cautioned that the release of patches does not eliminate the immediate risk, particularly for organisations with complex infrastructure or limited visibility into their software dependencies.
Dane Knecht, chief technology officer at internet infrastructure company Cloudflare, reported indications of emerging attacks. He said Cloudflare was “seeing early attacks emerging and are updating mitigations as new vectors show up”.
Don Smith, a cybersecurity specialist at the Sophos Counter Threat Unit, told BBC News that the vulnerabilities would “likely be a priority target” for attackers.
Smith said organisations faced a broader challenge than installing the latest security update. They first needed to identify every location where PHP was operating, including systems where it was embedded within other products.
The use of PHP is pervasive, it can sit beneath public websites, content management systems, hosting platforms and third-party products, sometimes without even being obvious to the organisation using it.
He also warned that organisations should investigate whether attackers “might have already have gained a foothold”.
That concern means software updates should be accompanied by checks for evidence of previous compromise, particularly where vulnerable services have been accessible from the internet.
According to CERT-EU, the potential exposure extends to PHP versions dating back to PHP 5, which was introduced in 2004.
The NCSC advised organisations using any version of PHP to assess their exposure rather than concentrating exclusively on outdated installations. Operators running older releases were encouraged to move to fully supported versions.
Emergency patching and mitigation guidance
The NCSC issued detailed instructions for organisations responding to CVE-2026-109618 and CVE-2026-109619. Its primary recommendation is to identify all PHP installations across an organisation’s infrastructure, prioritising systems accessible from the internet.
Security teams should assess those installations for exposure to both vulnerabilities and apply the latest fixed PHP versions.
The agency also advised organisations to monitor updates from third-party software vendors, particularly suppliers of applications, network appliances and services containing PHP components.
Software operators should implement additional hardening measures published by the PHP development team and monitor subsequent security releases.
Where an immediate update is not feasible, the PHP team has provided temporary mitigation guidance that organisations should assess and apply where appropriate.
If those protections cannot be implemented, or would require too much time, the NCSC said organisations should consider disconnecting vulnerable systems until the risks have been addressed.
For systems that cannot immediately be patched or disabled, the NCSC recommended investigating possible evidence of compromise before completing remediation.
That assessment should include checks for malicious changes, suspicious activity and backdoors that attackers may have installed.
Organisations without sufficient internal capabilities can seek assistance from an NCSC-assured Cyber Incident Response provider.
The agency also directed organisations to an inventory maintained by the Netherlands’ National Cyber Security Centre (NCSC-NL), identifying software products with PHP dependencies potentially exposed to the vulnerabilities.
Cybersecurity authorities across the EU, Australia and Japan have issued comparable warnings, reflecting concerns about the potential reach of the flaws.
The NCSC said it would continue monitoring possible effects on UK organisations and advised operators to maintain ongoing surveillance of third-party security updates, including those affecting products that bundle PHP.
For organisations responsible for affected infrastructure, the immediate priorities remain identifying PHP deployments, installing the released fixes, assessing signs of previous compromise and temporarily disabling systems that cannot otherwise be secured.
