The global cybersecurity community is on alert after the disclosure of two critical vulnerabilities in PHP, one of the web’s most widely used programming languages. Under certain conditions, the flaws could allow criminals to take control of servers, steal sensitive information and compromise websites without needing login credentials.
The disclosure on Wednesday 21 October 2026 prompted an immediate response from government agencies, technology companies and organisations worldwide. Several websites were temporarily taken offline as a precaution while administrators installed security updates.
The severity is reflected in vulnerability ratings reaching 9.2 out of 10.
What researchers discovered
The two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are collectively known as PHP2Shell and affect PHP itself.
The problem is therefore not confined to an individual website or plug-in. It concerns software underpinning millions of online services.
Popular content management systems using PHP include WordPress, Joomla and Drupal. Researchers demonstrated that the flaws could be exploited to execute malicious code remotely without the attacker first logging into a site.
Potential consequences include information theft, access to server files and data, website defacement and malware installation.
The underlying problems appear to have remained hidden in PHP’s code for more than a decade despite the language’s widespread daily use.
PHP’s reach does not mean every website is equally vulnerable
Cybersecurity company Wiz estimates that PHP is used by around 70% of websites, illustrating the potential scale of the issue.
That does not mean 70% of the internet has been compromised or that every PHP site is equally vulnerable. Actual risk depends on the PHP version, server configuration and protective measures.
Researchers nevertheless describe the disclosure as one of the most significant in recent years because it concerns fundamental software used across global internet infrastructure.
Government websites taken offline
The announcement had an immediate impact in several countries.
Government agencies and major organisations temporarily suspended some websites to reduce exposure until patches could be installed.
Such measures were reported in Finland and the Netherlands, while access problems were also recorded at websites belonging to major organisations and media outlets.
These outages are not necessarily evidence of cyberattacks. In many cases, administrators made a preventive decision to protect their systems.
AI helped uncover long-hidden flaws
One notable aspect of the case is artificial intelligence’s role in identifying and analysing the vulnerabilities.
Researchers at Calif and Wiz used advanced AI models, including OpenAI’s GPT-5.6 Sol and Google’s Gemini 4 Argon, to investigate weaknesses in PHP’s code.
These systems helped specialists analyse highly complex bugs and confirm how attackers might exploit them.
This changes the cybersecurity landscape. AI can help find problems that have escaped notice for years, but the same capabilities could also help criminals develop more effective attacks.
Emergency security releases
PHP’s developers released security updates on 21 October to address the two critical vulnerabilities.
The fixes were included in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with additional patches made available for certain older versions.
Experts advise website, business and online-service administrators to check their systems promptly and install the relevant updates.
Particular care is needed for online shops, news sites, business platforms and systems holding users’ personal data.
Updating WordPress or its plug-ins alone does not resolve these vulnerabilities, because the flaws are in the PHP software running on the server.
What internet users should know
Most ordinary internet users do not need to take a specific action, since website administrators and hosting providers are responsible for applying the fixes.
The case nevertheless underlines the value of strong, unique passwords, two-factor authentication and caution with suspicious emails.
Disclosure of these vulnerabilities does not, by itself, mean that users’ accounts have been compromised or that mass data leaks have occurred from PHP websites.
The case shows how even widely used technology infrastructure can prove vulnerable. Internet security is a continuing process of checking, updating and protection against evolving risks, rather than something completed when software is first installed.
