Critical PHP Core Vulnerabilities Spark Global Security Alerts and Outages
Two critical PHP core vulnerabilities rated 9.2 CVSS have triggered emergency global security advisories, widespread government outages, and industry-wide patching efforts.
Two critical vulnerabilities in the PHP programming language core, tracked as CVE-2026-109618 and CVE-2026-109619, have been uncovered, allowing attackers to execute remote code and compromise servers without authentication or administrative privileges. These flaws received a CVSS severity rating of 9.2. PHP, developed in the early 1990s as Personal Home Page, is an open-source language maintained by volunteers. According to W3Techs, it powers approximately 69.3% to 75% of websites with known server-side languages, forming the infrastructure for content management systems and e-commerce platforms such as WordPress, Drupal, Joomla, and Magento. Tiffany Paris, interim CEO of the Drupal Association, noted that all servers running any version of PHP released over the last twenty years are vulnerable, affecting a substantial portion of the internet.
Global Response and Emergency Advisories
On October 21, 2026, official security patches were released, and the PHP Foundation urged technology departments worldwide to update immediately. Intelligence, security, and cyber agencies issued urgent warnings to organizations. The NSA Cyber division posted on X that all organizations utilizing PHP should prepare for an immediate update, as these vulnerabilities frequently provide a direct path to the file system or database, advising systems to be taken offline if immediate updates are not feasible. Similar recommendations were issued by the UK's National Cyber Security Centre (NCSC). The White House confirmed it was briefed in the days leading up to the disclosure.
Japanese Prime Minister Sanae Takaichi posted on X advising administrators to check their active websites for PHP usage and prepare for the new patch, while the Dutch Prime Minister stated he was closely monitoring developments. The FBI cybersecurity division called for immediate action, noting that the two vulnerabilities could allow malicious actors to execute remote code in the PHP core and compromise sensitive networks. The bureau instructed administrators to immediately update installations, map environments, and monitor servers for suspicious activity such as unexpected command shells or file downloads, while reporting compromises to the FBI or via ic3.gov, alongside referencing CERT-EU Security Advisory 2026-018 and CISA's Known Exploited Vulnerabilities catalog.
AI-Assisted Discovery and Digital Arms Race
The flaws, which resided in the language code for a decade or more, relate to PHP's handling of error states and out-of-memory crashes, leaving corrupted data or use-after-free memory references exploited by subsequent requests. Discovered in August and kept confidential until patches were ready, the vulnerabilities were identified on August 1 by the Calif group using a language model during a code audit funded by OpenAI. Simultaneously, Israeli cybersecurity firm Wiz independently exposed the flaws using the Wiz Atlas research tool alongside Gemini 4 Argon and GPT-5.6 Sol models. Wiz explained that exploiting these flaws previously required an extremely complex chain bordering on human capability, a barrier eliminated by artificial intelligence.
OpenAI stated on X that it led a coalition to prepare fixes for these critical flaws, viewing this bug as one of the most impactful vulnerabilities in recent memory and a milestone for the AI era in detecting internet-scale security bugs. Cloudflare's CTO reported early signs of attacks, and Amazon's CISO CJ Moses revealed exploitation attempts against company honeypots starting October 17, confirming widespread active exploitation in the field.
Extensive System Outages and Long-Term Risks
The severe risk prompted proactive shutdowns globally. In the Netherlands, the National Cyber Security Centre took its site offline, followed by Overheid.nl, the Port of Rotterdam, major political party sites, and hospitals. Finland's Valtori shut down government network services, France placed all Interior Ministry sites under preventive maintenance including the Paris police website, and Denmark halted municipal services including school platforms. Wikipedia and the Internet Archive temporarily disabled systems, alongside 4chan, DeviantArt, and various mobile applications.
Censys data indicates that roughly 1.5 million out of 2.6 million hosts running PHP utilize unsupported versions lacking official patches, such as version 8.1 and below, while VirusTotal detects approximately 3.8 million open web servers running the language. WordPress operator Automattic stated its hosting services and Tumblr users are protected, and platforms like Wix and Squarespace do not support PHP and remain unaffected. Conversely, the risk is exceptionally high for small PHP sites and shared hosting providers like GoDaddy, Bluehost, and Hostinger, prompting GoDaddy to advise assuming all PHP sites are affected and requiring immediate updates.
