Security and web administration teams worldwide rushed to protect their systems after the developers of the widely used PHP programming language released emergency updates on Wednesday. The patches address two critical flaws that could give attackers dangerous remote control of victim systems.
The PHP Foundation identified the vulnerabilities as CVE-2026-109618 and CVE-2026-109619. According to its advisories, they affect "all PHP installations serving web requests" as far back as PHP 5, which was released in July 2004. Only PHP 8.2 and newer are still supported and will receive fixes, although the foundation noted that some distributions and third-party vendors continue to produce legacy patches. That caveat matters because foundational web layers such as PHP can linger forgotten and un-updated in older internet infrastructure. "There are no complete mitigations, updating is the only safe choice," the foundation wrote.
Lukasz Olejnik, an independent security consultant and visiting senior research fellow at King's College London, said: "This is not a drill." PHP has been a core scripting language for web development since the 1990s, and it underpins publishing systems such as WordPress and Drupal as well as e-commerce platforms like Adobe's Magento. Olejnik compared its reach to that of critical infrastructure and said millions of systems could be affected. The worst case, he warned, would be wormable malware hitting large parts of the internet.
The main concern is that malicious hackers will move faster than defenders. Cloudflare said it was "seeing early attacks emerging" before the PHP Foundation had published details or fixes. Security firm Sansec wrote ahead of the release, which came shortly before 10 am ET on Wednesday, that it expected "mass attacks to start within 15 minutes."
Security and compliance consultant Davi Ottenheimer said the bug sits in a file upload interface that is "like a front door with no lock." He explained that an attacker need not know which site or software they are targeting: "They send one crafted upload to any server they can find, and that is the entire attack."
Some organizations took their websites offline as a precaution before the updates arrived. Multiple Finnish government sites, including the National Land Survey, were reported to be inaccessible, and Reuters reported that French government websites and the Port of Rotterdam's website were also down. Olejnik urged everyone to patch immediately, saying that AI has made exploiting such flaws a matter of minutes.
Wiz, the security company owned by Google, said its researchers found the vulnerabilities partly with the help of AI tools. OpenAI and security firm Calif say they discovered the issues independently and later worked together. Wiz called its exploitation demonstration php2shell and said some cases can be exploited "fairly easily." The company said the flaws can let unauthenticated attackers execute code on affected servers or read sensitive process memory, which may hold passwords, authentication tokens, API keys and certificates.
The PHP Foundation had posted an "advance notice" on October 20 saying fixes were coming. It gave no specifics on the flaws or affected versions but rated both 9.2 out of 10 on the Common Vulnerability Scoring System. It reserved the right to release earlier if details became public or active exploitation appeared. Bleeping Computer and Ars Technica reported that some details may have leaked before the planned publication.
Government agencies issued their own guidance. The EU's Computer Emergency Response Team and Australia's cybersecurity agency told IT teams to prepare for rapid updates, which could mean temporary downtime. The UK's National Cyber Security Center urged organizations to "prepare for immediate updating," and to consider taking systems offline if immediate remediation is not possible. It advised identifying all PHP systems, prioritizing internet-facing ones, monitoring them for exploitation, applying updates and watching for vendor patches in software that embeds PHP.
Brett Leatherman, the FBI's cyber assistant director, said organizations that find signs of compromise should isolate the system, preserve web server and PHP logs, and report it to their local FBI field office. Such reports, he said, help the bureau identify the actors involved and warn other organizations before they become victims.
