Two critical flaws in PHP, the language that quietly runs much of the internet, sent officials across Europe and North America scrambling to patch, or to switch sites off
Most people have never heard of PHP. It still sits behind a huge share of the sites they use every day.
This week, a pair of critical security flaws in the 30-year-old programming language pushed cyber agencies to issue urgent warnings. Some governments took public websites offline as a precaution.
What went wrong?
On Wednesday, 21 October, the PHP team released emergency updates for two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. The UK’s National Cyber Security Centre (NCSC) said the flaws could let attackers run commands on any web server running PHP. The issue involves an out-of-memory condition that corrupts memory. Under certain conditions, an attacker could exploit that corruption to achieve unauthenticated remote code execution, with no login needed.
The two flaws work differently:
- CVE-2026-109618: When PHP runs out of memory, it can be interrupted while internal request data is only partly set up. The cleanup step may then treat that broken data as valid.
- CVE-2026-109619: Internal state from one request can outlive its freed memory. A later request handled by the same worker may then use that stale state.
Newsweek reports that the pair has been nicknamed “PHP2Shell”. Both carry a severity score of 9.2 out of 10 on the CVSS v4.0 scale.
Why it matters
PHP is a server-side scripting language. It builds web pages, talks to databases and runs the logic behind many sites. Its reach is wide: WordPress, Drupal, Joomla, Magento and WooCommerce all depend on it. ABC News cites an estimated 70% of all websites.
The NCSC says every PHP version is potentially affected, not just old ones.
A scramble across borders
Government sites went dark in several countries. Per reports, Finland temporarily shut down its public web services. The Dutch cyber-security agency took its own site offline. Canadian government pages were pulled for “urgent maintenance”. UK outlet LBC reported that sites linked to the Met Police and the BBC show The Traitors were also affected.
In the US, the Cybersecurity and Infrastructure Security Agency (CISA) urged organisations to patch immediately. It said it had not observed exploitation at the time. The NSA reportedly advised organisations that could not update to take systems offline.
Found by AI
According to the BBC, researchers at Wiz and Calif found the flaws using OpenAI models. Wiz is reported to have called them among the most severe ever discovered by AI. The PHP Foundation said it had entered PHP into OpenAI’s “Patch the Planet” programme, and a security audit began in July.
Leaks and a race against attackers
Details of the flaws leaked early. Reports say proof-of-concept exploits were circulating before fixes were ready, which forced the PHP team to bring its release forward by a day. Cloudflare said it saw attack traffic before the patch landed, according to the same reports.
What organisations should do?
The NCSC’s priority actions:
- Find every PHP system, starting with internet-facing ones. Don’t limit the search to outdated versions.
- Update to the latest fixed version. Patched releases include PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- Apply the PHP Foundation’s temporary mitigations if you can’t update yet.
- Consider taking the system offline if you can’t mitigate quickly.
- Check for compromise, including backdoors, if you couldn’t patch straight away. NCSC-assured incident response providers can help.
- Watch for vendor updates, since appliances and services may bundle PHP. NCSC-NL has published a list of potentially affected software.
A warning for WordPress owners
Security firm Wordfence warned that WordPress’s automatic updates will not install the PHP fix. Automattic said that updating WordPress, a theme or plugins alone doesn’t fix the underlying flaw. Site owners need to confirm who updates PHP on their servers, whether that’s a host or an in-house team.
What ordinary users can do
You can’t patch this on your own phone or laptop. The risk sits with the sites and servers you rely on. Newsweek advises treating unexpected login or password-reset messages with caution.
The bigger picture
The episode shows how AI is speeding up vulnerability discovery, and how little time defenders get once a flaw is found. The NCSC has already published guidance on preparing for a “vulnerability patch wave”.
Sources: NCSC (ncsc.gov.uk), BBC News, and others.