The PHP Foundation released a patch on October 21 for two critical vulnerabilities in the language's core engine, and security agencies in the US, UK, EU, Singapore and Australia are telling website operators to update immediately or take systems offline.
What PHP is
PHP is a server-side scripting language from the early 1990s that generates dynamic pages, talks to databases and runs backend logic before the HTML reaches your browser. According to Wiz, PHP powers 70% of the world's websites, including WordPress, Drupal, Joomla and MediaWiki, the software behind Wikipedia.
PHP is not limited to websites. The NCSC warns it is bundled into third-party appliances and services, and Daniel Stewart, head of threat intelligence at LRQA, told the BBC it is commonly found in the management interfaces of network appliances, load balancers and embedded devices.
What the vulnerability is
The bugs, dubbed php2shell, are grouped under CVE-2026-109618 and CVE-2026-109619 with a CVSS score of 9.2 out of 10. Both stem from how PHP handles out-of-memory errors while processing a request.
- CVE-2026-109618: an OOM error interrupts PHP while internal request data is only partially initialized, and cleanup then treats invalid data as valid
- CVE-2026-109619: request-owned internal state survives after its memory is freed and can be reused by the next request handled by the same worker
- Outcome: unauthenticated remote code execution or disclosure of process memory, including passwords, tokens, API keys and certificates
Wiz demonstrated pre-authentication RCE on WordPress, Drupal and Joomla, but the flaw sits in PHP itself, not in the applications: even a "Hello World" script on an unpatched version is exposed. Every release from the past decade, back to PHP 5.4, is affected by at least one of the bugs.
The AI angle
The vulnerable code had been there for more than ten years, but turning it into a working exploit required an exceptionally complex chain of steps. Wiz says it used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, and that a single researcher completed in a week what would previously have taken a team months.
Calif researcher Ryan Austin told the BBC it was "the most serious vulnerability I've ever found". Details of the discovery leaked online ahead of schedule, forcing the PHP team to rush out its announcement.
What happened after disclosure
- Wikimedia took down several systems as a precaution
- The Finnish government, Edinburgh council, the Dutch cyber security agency and some BBC pages went offline
- The University of Geneva took 32 sites down as a precaution
- Orange suspended access to certain services globally while it deployed fixes
- SoftBank temporarily suspended earthquake and tsunami emergency alerts in Japan, according to local media
Cloudflare CEO Matthew Prince wrote on X that the company's network saw "thousands" of exploit attempts in the 10 hours before the announcement, tens of thousands in the 45 minutes after, hundreds of thousands within two hours and millions now. Amazon said it was targeted in multiple attempts days before public disclosure. As of Friday morning, no successful attacks had been reported.
What you need to do
The NCSC lists four priority actions, in order:
- Identify every system running PHP, internet-facing first, regardless of version
- Update to the latest PHP release; if you cannot, apply the temporary mitigations published by the PHP Foundation
- If mitigations are not possible either, take the system offline until it is fixed
- If you cannot update or disable the system immediately, check it for signs of compromise and attacker backdoors before upgrading
The NSA told all organisations using PHP to take systems offline if they cannot patch immediately and warned the flaw offers a "direct path" to a system's database. If a hosting company runs your site, ask whether the PHP patch has been applied: updating WordPress or its plugins does not fix it.