Two critical PHP flaws put the web on alert as emergency patches arrive

Organizations are scrambling to protect themselves following the disclosure of two critical vulnerabilities in commonly used code that powers much of the internet. The flaws discovered in the PHP scripting language could allow attackers to perform unauthenticated remote code execution (RCE).

On Wednesday morning, the PHP Foundation released patches for affected versions, and said it is “imperative” that organizations running PHP patch immediately. It said that all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It considers the risk highest for mod_php, where an unauthenticated request can trigger exploitation before application code runs.

In response to the disclosures, some government websites in Europe, including those in the Netherlands and Finland, as well as those of other organizations worldwide, went offline as a precautionary measure.

PHP is ‘the web itself’

PHP is a widely-used, open source server-side scripting language that underlies websites like WordPress, which powers 43% of the web, as well as Mailchimp, Drupal, Magento, Laravel, and parts of Slack and Zoom, and numerous others.

The impact is not limited to websites, noted the Netherlands National Cyber Security Centre (NCSC-NL) in its description of the flaws, collectively dubbed PHP2Shell. PHP is also embedded in appliances, network devices, management interfaces and other vendor products where administrators may not be able to update PHP directly. And CERT-EU, an organization that tracks cybersecurity threats in the European Union, also warned that many commercial and open-source products use PHP as a backend technology, and these could be also impacted by the flaws, even if they do not directly expose a PHP installation.

This makes the vulnerabilities all the more serious. CVE-2026-109618, which has a 9.2 severity rating on the common vulnerability and scoring system (CVSS), could allow RCE via memory corruption during out-of-memory handling (OOM), a strategy that operating systems (OSes) and apps use when physical RAM and swap spaces become exhausted.

CVE-2026-109619, also with a score of 9.2, remote code execution via stale request-owned global state reused by a later request on the same worker.

Both flaws sit in parts of PHP that nearly every request touches: Memory management and error handling, the PHP Foundation noted. This makes both bugs extremely serious, and also difficult to fix without impacting compatibility or performance. Organizations should begin with the assumption that they are exposed.

“What makes these vulnerabilities significant is where they sit,” said Forrester senior analyst Madelein van der Hout. PHP underpins 70% of websites, making this a huge concentration risk.

“Checking the corporate website alone is not enough,” she said. “Organizations need to establish where they are exposed and prioritize internet-facing systems.”

Affected organizations should update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Linux and long-term support (LTS) vendors received patches in advance, the Foundation said, so organizations should check with their vendors about fixes.

PHP 8.1 and other end of life versions no longer receive updates from the PHP project, although some distributors and LTS vendors provide backported fixes, so organizations still running unsupported versions should also check with their vendor.

Those relying on the volunteer-maintained rpms.remirepo.net should switch distribution packages or build from source to immediately apply updates, the PHP Foundation advised.

Those unable to patch immediately should take the preventive action it described to reduce exposure, CERT-EU said, warning that these mitigations do not make an installation safe.

“This is what an internet-scale vulnerability looks like,” said Neatsun Ziv, CEO of runtime app security company OX Security. “When a flaw hits technology this ubiquitous, the blast radius isn’t one product or one industry. It’s the web itself.”

Researchers from his company independently reproduced the flaws and found that the vulnerable functionality is enabled by default, and has existed in PHP since version 5.4.

Still, experts emphasize that patching is just one element of response. Speed matters, Forrester’s van der Hout noted, and security teams need to identify everywhere PHP is running, prioritize exposed systems, apply the official fixes promptly and investigate for signs of compromise.

“A patch fixes the vulnerability; it does not necessarily remove access an attacker may already have established,” she said.

Offline does not mean hacked

With rumors of exploits already available on the dark web, taking services down to protect and then patch them is a pragmatic choice, experts say.

Forrester’s van der Hout emphasized that taking a website offline does not mean it has been hacked. If an organization cannot yet patch or adequately protect a potentially vulnerable system, temporarily taking it offline can be a “proportionate risk decision.” That is, organizations accept a short loss of availability rather than risk a potential serious compromise.

Ultimately, this is a test of operational resilience, rather than just patch management, van der Hout said. Organizations must decide whether they can keep services running, and who has the authority to take them offline if necessary.

“A temporary shutdown can be the right decision, but it shows how a software vulnerability can become a business disruption even without a confirmed breach,” she said.

AI’s role in defense, as well as hacking

OpenAI has posted a blog detailing its role in the PHP response, explaining that red-teaming organization Calif identified a critical flaw using GPT‑5.6 Sol as part of OpenAI’s Patch the Planet initiative. Wiz also independently discovered and reported both vulnerabilities, and OpenAI partners contributed research, technical support, and coordination ahead of PHP’s disclosure.

OpenAI is sharing a PHP version checker as a Codex skill to help organizations identify vulnerable PHP versions and apply the right updates.

“Given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory,” OpenAI said.

The company also indicated that this is a turning point in AI’s role in security; frontier AI discovered the vulnerabilities before attackers did, giving maintainers a head start, a “defender’s window.”

“It highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits,” OpenAI noted.

Matt Saunders, DevOps lead at global technology provider The Adaptavist Group, emphasized the latter point: “As soon as the vulnerability is announced, legions of AI bots will be looking for systems to exploit,” he said, pointing out that these bots can chain together multiple lower-vulnerability attacks combined with these new critical ones to hack into organizations.

This means, he said, “the blast radius from a breach is potentially much wider now with AI-embellished attacks available to those who choose to use them.”