Internet security teams worldwide are racing to avert a potential crisis after the developers of PHP issued emergency patches on Wednesday. The updates address two critical vulnerabilities, identified as CVE‑2026‑109618 and CVE‑2026‑109619, that affect “all PHP installations serving web requests” dating back to version 5, first released in July 2004. Only PHP 8.2 and newer remain officially supported and will receive the fixes, the PHP Foundation said, though some third‑party vendors still provide legacy patches. The warning is significant because PHP underpins much of the web’s infrastructure and many old installations may be left unpatched.
“The only safe choice is to update,” the foundation wrote in its advisory, noting that no complete mitigations exist. Independent security consultant Lukasz Olejnik, a senior research fellow at King’s College London, echoed the urgency, describing the situation as anything but a drill. Since its inception in the 1990s, PHP has become a cornerstone of web development, powering platforms such as WordPress, Drupal, and Adobe’s Magento e‑commerce suite.
Olejnik compared the language’s ubiquity to critical national infrastructure, saying, “The impact is enormous. Millions of systems could be affected, and if attackers move quickly the worst‑case scenario is wormable malware spreading across large portions of the internet.” Security teams fear that malicious actors will exploit the flaws before patches are applied. Cloudflare reported early signs of attacks emerging even before the PHP Foundation disclosed the vulnerabilities and released the patches just before 10 a.m. ET on Wednesday. Sansec warned that mass exploitation could begin within 15 minutes of the release.
Long‑time security consultant Davi Ottenheimer described the bug as a “file upload interface that’s like a front door with no lock.” He explained that an attacker does not need to know the target site or its software; a single crafted upload to any vulnerable server could trigger the exploit.
In anticipation of the patches, some organizations took precautionary steps by taking websites offline. Reports indicate that several Finnish government sites, including the National Land Survey, were temporarily inaccessible, as were French government portals and the Port of Rotterdam’s website.
“Everyone should patch immediately; exploitation can happen very fast and at scale,” Olejnik warned. “AI makes exploiting such vulnerabilities almost immediate—within a minute or so.” Researchers at Wiz, a security firm owned by Google, said they discovered the flaws partly using AI tools, while OpenAI and the security firm Calif also reported independent discoveries and collaboration. Wiz demonstrated an exploitation scenario dubbed php2shell, noting that the vulnerabilities can be leveraged “fairly easily.” Their research indicated that unauthenticated attackers could execute code on affected servers or read sensitive process memory, potentially exposing passwords, authentication tokens, API keys, and certificates.
The PHP maintainers first hinted at the upcoming fixes on October 20, posting a brief notice that the two flaws carried a “critical” CVSS score of 9.2 out of 10. The advisory reserved the right to release patches earlier if details became public or active exploitation was observed. Some reports suggest that information about the vulnerabilities may have leaked before the official announcement.
The early warning gave developers and security teams a chance to prepare. The EU’s Computer Emergency Response Team (EU‑CERT) and Australia’s cybersecurity agency urged IT teams to be ready to apply updates promptly, even if it meant taking sites offline temporarily. The UK’s National Cyber Security Centre (NCSC) issued a similar alert, advising organizations to “prepare for immediate updating of systems” that run PHP and to consider offline mitigation when rapid remediation is not possible. The NCSC also recommended that businesses inventory all PHP‑based systems, with particular attention to those exposed to the internet.