PHP Releases Emergency Patches for Two Critical Flaws as Governments Tell Sites to Update or Go Offline

The maintainers of PHP, the scripting language estimated to run about 70% of websites, released emergency patches on Wednesday, Oct. 21, for two critical vulnerabilities. Fixes began going out after 10 a.m. Eastern.

The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. PHP rates both 9.2 out of 10 on the CVSS v4.0 severity scale. They can allow unauthenticated remote code execution, meaning an attacker needs no login to run code on a vulnerable server. The bugs are being called PHP2Shell.

What happened, and when

PHP's security team put out its warning Tuesday evening, Oct. 20, telling users to prepare to upgrade as soon as a release was available. The PHP Foundation's executive director, Elizabeth Barron, said: "These are critical vulnerabilities and anyone using PHP should upgrade as soon as possible."

The disclosure was supposed to be coordinated. It was not clean.

Huntress, a security monitoring firm, said details of the flaws were "leaked online before their coordinated disclosure and before patches were released," and that attacks had been reported. How the details got out has not been explained. The security firm watchTowr said it could confirm the leak was real.

The scramble

Hundreds of websites went offline Wednesday as administrators reacted. In the Netherlands, the Port of Rotterdam and the government portal Overheid.nl pulled public-facing sites. Nintendo took services offline while it addressed the bugs.

Governments weighed in across the board. The EU, U.S., Germany, Japan, Australia, the U.K. and the Netherlands all issued warnings. The FBI Cyber Division told organizations to "immediately update affected PHP installations" and, if that was not feasible, to take the system offline "until it can be fully mitigated." The NSA's Cybersecurity Collaboration Center and the U.K.'s National Cyber Security Centre gave the same advice. CISA said it "strongly urges organizations to immediately patch."

The U.K. agency said the flaw "could allow an attacker to trigger an out-of-memory condition in PHP that results in memory corruption," which under certain conditions could be exploited for unauthenticated remote code execution. It said organizations running any version of PHP are vulnerable.

Are attackers getting in?

Attempts are confirmed. Successful compromises are not.

Cloudflare CTO Dane Knecht said the company was "seeing early attacks emerging" and updating its firewall mitigations. Daniele Molteni, a Cloudflare director of project management, said the company had seen "spikes of thousands of attempts" and attackers changing tactics to get around protections.

Jake Knott, head of threat intelligence at watchTowr, said his firm is seeing in-the-wild exploitation attempts using proof-of-concept tools built with AI assistance. "Whilst nobody has been successful to date, we don't expect that will last long," he said.

CISA said it had not observed exploitation as of its publication time. The Australian Cyber Security Centre said earlier it was not aware of active exploitation. Those statements and the Cloudflare and watchTowr observations differ mainly in what they count: attempts versus confirmed breaches.

Found by AI

Researchers at the security firm Calif first caught the flaw in July using an OpenAI model, according to OpenAI. CNET reported that OpenAI named the model as GPT-5.6 Sol. Google's Wiz team independently found and reported the bugs in August.

OpenAI, Google and Calif completed a patch in early October, according to OpenAI. OpenAI said it led a coalition of maintainers, researchers and security providers for two months to prepare fixes before disclosure.

In its post, OpenAI called the bug "one of the most impactful vulnerabilities in recent memory" and said it marks "a new phase, where AI can find security bugs with internet-scale impact." The company also acknowledged the same capabilities can help attackers rapidly build offensive tools, and said it expects similar findings to "increase sharply in the coming months."

Calif researcher Bruce Dang put the stakes in plain terms. "Imagine, nobody knew anything when, boom, today dropped. That would be extremely bad," he told USA Today. In this case the two-month head start was partly undercut by the leak.

The unpatchable half

Installing the fix is the easy part. Finding every place PHP runs is harder.

Sophos official Don Smith said PHP "can sit beneath public websites, content management systems, hosting platforms and third-party products, sometimes without even being obvious to the organization using it." PHP powers WordPress, Drupal, Joomla and Magento, plus sites like Wikipedia, Etsy and Flickr, according to a usage-tracking site. WordPress alone is estimated at more than 40% of all websites.

Then there is the abandoned tail. PHP's security team has said PHP 8.1 and older no longer receive updates from the project. Cisco Talos estimates about 50% of all PHP systems worldwide will not receive an official patch for these flaws, because aging sites run unsupported versions and have no easy upgrade path.

That leaves millions of servers that can be hijacked, used to spread malware or emptied of data.

What to watch

The immediate job falls on site owners and hosts: inventory PHP installs, patch, and pull offline whatever cannot be patched. Cloudflare's Knecht has described its firewall rules as a stopgap, not a substitute for the official fix.

The open questions are how the details leaked before the patch and whether any of the thousands of attempts Cloudflare logged turn into confirmed breaches. watchTowr's Knott does not expect the streak of failed attempts to hold.