Internet security teams are scrambling to patch critical flaws in the PHP programming language that could allow attackers to take remote control of web servers. The PHP Foundation released emergency updates on Wednesday to fix two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which affect all PHP installations serving web requests back to version 5.
Version 5 launched in July 2004, but only PHP 8.2 and newer versions are currently supported. The Foundation noted that some third-party vendors still produce legacy fixes for older systems. This distinction matters because foundational web layers like PHP can persist in historic internet infrastructure without being updated.
Updating is the only safe choice. The PHP Foundation stated there are no complete mitigations for these flaws. Security experts warn that overlooking unpatched systems could lead to dire consequences.
Lukasz Olejnik, an independent security consultant and visiting senior research fellow at King’s College London, says the situation is urgent. Since its development in the 1990s, PHP has become essential for web development. Everything from publishing systems like WordPress and Drupal to e-commerce platforms like Adobe’s Magento relies on it.
Olejnik compares the widespread use of the language to critical infrastructure. The impact is enormous. Millions of systems could be impacted, especially if attackers exploit these vulnerabilities quickly. The worst case is wormable malware affecting big chunks of the internet.
The overriding fear is that malicious hackers could begin exploiting deployments before they are fixed. Cloudflare reported seeing early attacks emerging before the PHP Foundation released fixes. Security firm Sansec wrote that mass attacks were expected to start within 15 minutes of the release. The updates came out just before 10 am ET on Wednesday.
Most of the web runs on PHP. Davi Ottenheimer, a longtime security and compliance consultant, describes the bug as a file upload interface that acts like a front door with no lock. An attacker does not need to know which site they are hitting or the actual software it runs. They send one crafted upload to any server they can find.
Some organisations took their websites offline as a precautionary measure ahead of the updated versions. Multiple sites belonging to the Finnish government, including the National Land Survey, were inaccessible. French government websites and the Port of Rotterdam’s website were also offline, according to Reuters.
Exploitation may happen very fast and at a scale. Olejnik added that AI makes exploiting such vulnerabilities of immediate importance. Like, indeed, a minute or so.
Security company Wiz, which is owned by Google, claimed its researchers discovered the vulnerabilities in PHP partially using AI tools. OpenAI and security firm Calif also say they independently discovered the issues and worked together. Dubbing an exploitation demonstration php2shell, the Wiz researchers write that in some cases the vulnerabilities can be exploited fairly easily.
The vulnerabilities can allow unauthenticated attackers to execute code on affected servers or read sensitive process memory. That memory may contain passwords, authentication tokens, API keys and certificates belonging to other requests or the server itself.
Details of the upcoming vulnerabilities first appeared from the maintainers behind PHP on October 20. In a short post on the PHP website, the PHP Foundation wrote it was giving advance notice of the security flaws and upcoming release of the fixes. While omitting specific details about the vulnerabilities or the versions impacted, it said both flaws are considered to have a critical 9.2 score out of 10 on the Common Vulnerability Scoring System (CVSS).
We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild. The security warning on the PHP site said ahead of Wednesday’s release. According to reports from Bleeping Computer and Ars Technica, some details about the vulnerabilities may have leaked before they were due to officially be published.
The early warning from the PHP Foundation may have given some developers, security teams, and companies enough of a heads up to start preparing to update systems using PHP. Ahead of the details being published, warnings from the EU’s Computer Emergency Response Team (EU-CERT) and Australia’s cybersecurity agency said IT teams should be prepared to update their systems as soon as possible, with the potential for websites to be taken offline while fixes are applied.
Similarly, the UK’s National Cyber Security Center (NCSC) published an alert saying organisations should prepare for immediate updating of systems using PHP. Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.
The NCSC advises that organisations and businesses should identify systems running PHP across their tech infrastructure. There should be a particular focus on systems using PHP that are connected to the internet, including monitoring them for any potential exploitation. The next step is applying PHP updates as they are available and monitoring for updates from software companies as they may use PHP within their apps or services.
If you find signs of compromise, isolate the system, preserve your web server and PHP logs, and report it to your local FBI field office. Brett Leatherman, the FBI’s cyber assistant director posted online. Those reports help us identify the actors involved and warn other organisations before they become victims.
What it means
For people making things online, the practical change is strict. You must update your PHP version immediately. Leaving legacy systems online invites automated attacks that can steal credentials or lock down your site. There is no safe middle ground.
