Two critical vulnerabilities in PHP have put websites, online stores and government applications around the world at risk. The language's developers have released emergency patches after it became clear that the weaknesses could allow remote code execution without user authentication.
The issues are labeled CVE-2026-109618 and CVE-2026-109619 and are rated 9.2 out of 10 on the CVSS v4.0 system. According to the PHP team, they affect all installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is assessed as highest for systems with Apache and mod_php, where an attack can be triggered by an unauthenticated request before the specific application code is executed.
“Effective immediately, all organizations using PHP in their systems are advised to prepare for an update that addresses two critical vulnerabilities“, the US National Security Agency said. It recommended that systems that cannot be updated immediately be disconnected from the network until the risk is resolved.
Four major fixes have been released
The versions affected are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP team states that installing the update is the only safe solution. Temporary settings can limit some of the attack vectors, but do not make systems completely secure.
Users of PHP 8.1 and older versions face an additional problem, as these releases no longer receive official updates from the project. For some of them, individual distributions and long-term support vendors may provide backported fixes. PHP 8.2 will receive fixes until December 31, 2026.
Sites were temporarily taken down
Due to the risk, several organizations have temporarily taken down publicly available PHP systems. These include government agencies in Finland, the Dutch Cybersecurity Agency, and the lower house of the Dutch parliament. The Edinburgh City Council website was also temporarily unavailable, as were pages for several BBC programs.
The Wikimedia Foundation also said it was working to fix the vulnerabilities and had taken some of its systems offline as a precaution. Platforms that use PHP through hosting services, content management systems or third-party software products are also potentially affected.
The vulnerabilities were discovered using artificial intelligence
The issues were discovered by researchers at Calif and Wiz, who worked with the PHP Foundation as part of the Patch the Planet initiative. According to OpenAI, Calif discovered one of the weaknesses using the GPT-5.6 Sol model, while Wiz independently discovered and reported both vulnerabilities.
OpenAI described the case as one of the most serious security issues in recent years. The company said that artificial intelligence has allowed vulnerabilities to be discovered before attackers can exploit them, but warned that the same capabilities can speed up the development of exploits.
PHP is used in a large part of the world's websites and is the basis of popular platforms such as WordPress, Drupal, Joomla and Magento. It is its widespread distribution that makes timely updating of servers and checking all external components a major task for administrators.
Sources: techcrunch.com