PHP Developers Patch Critical Flaws Threatening Millions of Websites

Two critical vulnerabilities in PHP, a programming language used across millions of websites, prompted emergency security updates on October 21, 2026, after security researchers warned that attackers could exploit vulnerable servers. The PHP Foundation identified the flaws as CVE-2026-109618 and CVE-2026-109619, raising concerns about remote code execution and the exposure of sensitive information.

According to the PHP Foundation's security advisories, the vulnerabilities affect web-request processing across PHP installations dating back to version 5, released in July 2004. However, only PHP 8.2 and newer remain officially supported and are eligible for security patches, although some distributions and third-party vendors continue providing fixes for older versions.

The foundation emphasized that applying updates is essential because no complete workaround eliminates the vulnerabilities. Its advisory stated, "There are no complete mitigations, updating is the only safe choice," according to the PHP Foundation.

The flaws received a critical severity score of 9.2 out of 10 under the Common Vulnerability Scoring System, according to an advance warning published on October 20. The foundation initially withheld technical details while preparing the security releases.

The foundation's preliminary warning explained its approach to releasing the fixes: "We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild," the PHP Foundation wrote.

PHP underpins widely used publishing platforms, including WordPress and Drupal, as well as e-commerce software such as Adobe's Magento. Its extensive deployment means that unpatched systems could expose organizations across multiple industries to similar attacks.

Independent security consultant and King’s College London visiting senior research fellow Lukasz Olejnik warned that the situation required immediate attention. "This is not a drill," Olejnik said.

Olejnik described the potential scale of the problem in terms of the internet's dependence on PHP. "The impact is enormous," he said, warning that millions of systems could be affected.

He also highlighted the possibility that attackers could use automated techniques to spread malicious software between vulnerable systems. "Everybody should patch immediately, exploitation may happen very fast and at a scale," Olejnik said.

Olejnik further warned that artificial intelligence could accelerate the exploitation of newly disclosed flaws. "AI makes exploiting such vulnerabilities of immediate importance. Like, indeed, a minute or so," he said.

Security teams were already reporting suspicious activity before the vulnerabilities were publicly detailed. Cloudflare said it was "seeing early attacks emerging," indicating that attempts to exploit the flaws may have begun before the emergency patches became available.

Security firm Sansec anticipated a rapid increase in attack activity ahead of the release. "We expect mass attacks to start within 15 minutes of the release," the company wrote before the updates became available shortly before 10 a.m. Eastern Time on Wednesday.

Longtime security and compliance consultant Davi Ottenheimer compared the vulnerable functionality to an exposed entry point. "Most of the web runs on PHP and this bug is in a file upload interface that's like a front door with no lock," Ottenheimer said.

Ottenheimer explained that an attacker could potentially target servers without first identifying the software operating on each website. A crafted file upload could be enough to trigger an attack against an exposed system.

Research from Wiz, a cybersecurity company owned by Google, indicated that the vulnerabilities could have serious consequences for affected servers. The company said its researchers used artificial intelligence tools during part of their discovery process.

Wiz described the potential technical impact in its research: "The vulnerabilities can allow unauthenticated attackers to execute code on affected servers or read sensitive process memory," the company wrote.

The company warned that exposed memory could contain passwords, authentication tokens, application programming interface keys and digital certificates associated with other requests or the server itself. Wiz named its exploitation demonstration php2shell and reported that some attack scenarios could be carried out "fairly easily."

OpenAI and cybersecurity firm Calif also said they independently discovered the vulnerabilities and worked together. The PHP Foundation's initial public notice on October 20 had given developers and security teams advance warning that emergency updates were forthcoming.

Government and infrastructure websites took precautionary measures while organizations prepared to install the fixes. Reuters reported that multiple Finnish government websites, including the National Land Survey, were inaccessible, alongside French government websites and the Port of Rotterdam's website.

European and Australian cybersecurity agencies urged technology teams to prepare for prompt updates. The United Kingdom's National Cyber Security Center also advised organizations to identify PHP installations throughout their infrastructure, prioritizing internet-facing systems.

The UK agency's guidance stated that organizations should "prepare for immediate updating of systems" running PHP. It also warned that "Where immediate remediation is not feasible, organizations should consider taking the system offline until it can be fully mitigated," the National Cyber Security Center advised.

Security teams were advised to monitor internet-connected PHP systems for exploitation attempts, apply available patches and check for additional updates from software providers whose applications incorporate PHP. Organizations that detect signs of compromise should isolate affected systems.