ع
The PHP Foundation issued emergency patches on October 21, 2026, for two vulnerabilities rated 9.2 out of 10 that enable unauthenticated remote code execution on web servers. Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws involve memory corruption during out-of-memory conditions and reuse of stale global state after fatal errors. According to the PHP Foundation, these issues reside in core components that nearly every web request engages, potentially allowing attacks before application code executes. Security teams described the bugs as particularly dangerous given PHP’s central role in web infrastructure.
PHP stands for PHP Hypertext Preprocessor and functions as a server-side scripting language that dynamically assembles web pages from server data. Web technology tracker W3Techs data places its usage at roughly 70 percent of all sites where the language can be identified. Palo Alto Networks figures show more than 22 million exposed instances potentially vulnerable to the defects. The situation raised questions about what PHP is and why it sparked a global cyber-security scramble.
Researchers from Wiz, Calif and participants in OpenAI’s Patch the Planet program identified the vulnerabilities with assistance from AI models between August and September 2026. A WIRED assessment found that the AI tools dramatically accelerated discovery of flaws that had persisted undetected for more than 20 years. The PHP Foundation credited the collaborative effort in its public advisory while noting that only supported versions from 8.2 onward received full patches.
Details of the flaws, including a demonstration video for an exploit tool named PHP2Shell, leaked online ahead of the planned coordinated release. The Register reported that PHP maintainers attributed the premature disclosure to supply chain security provider Chainguard, which published fixed images more than six hours before the embargo lifted. This breach, the foundation stated, enabled attackers to study the binary differences while most users awaited the official announcement.
Government agencies and major organizations responded by taking precautionary steps across multiple countries. Finnish government services, the Port of Rotterdam, French interior ministry websites, Edinburgh council pages and several BBC programme sites were temporarily removed from public access. The Wikimedia Foundation disabled elements of its infrastructure supporting Wikipedia until updates could be verified, as reported across outlets including the BBC.
CERT-EU, the UK’s NCSC and other agencies advised that organizations unable to patch immediately should isolate internet-facing PHP applications from public networks. Computer Weekly reported that authorities emphasized scanning unpatched legacy systems for signs of prior compromise or backdoors before upgrades. The PHP Foundation described prompt remediation as imperative to block potential server control, data theft and website defacement.
Initial exploitation attempts appeared in network telemetry even prior to the patches’ availability, according to firms such as Hadrian and Sansec. Sansec wrote, “We expect mass attacks to start within 15 minutes of the release.” The episode has renewed focus on legacy PHP deployments and the expanding influence of AI in vulnerability research and exploit development.
