Critical PHP flaws lead to website shutdowns worldwide
Critical PHP flaw enables remote code execution – All users should update immediately
Websites worldwide have gone offline after two critical vulnerabilities/flaws were discovered in PHP, the language used by almost 70% of the world’s websites. All users of PHP have been told to update immediately to newer versions, as both flaws can allow “unauthenticated remote code execution”.
Governments and agencies worldwide have asked website operators to address these vulnerabilities. As a result, most major websites have been temporarily offline to apply updates. This includes government websites, the BBC, Wikipedia, and basically the whole internet. Before you ask, yes, we have updated.
Without updates, unpatched websites run the risk of being taken over by cybercriminals. Now that these vulnerabilities are known, it is only a matter of time before they are exploited by bad actors. Many websites have been taken offline until they can be patched.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.
Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.
– PHP Security Advisory
A group that included Calif, OpenAI, and Wiz discovered these two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. While OpenAI claims that “frontier AI” was key to discovering these PHP flaws, the researcher who found them says they used publicly available AI models.
These PHP flaws have existed for decades. That said, until now, this flaw was unknown and unexploited. With updates, affected websites can be secured. That said, people who rarely update/maintain their deployed websites now face a higher risk of severe cyberattacks if they don’t.
One problem facing PHP users isn’t just patching their software, but finding every place PHP is used. PHP can often be used without system operators realising it. It powers WordPress, Drupal, Joomla, and Magento-based websites, and a lot of software runs PHP without advertising it. Not all websites use PHP, but most do. It is only a matter of time before bad actors exploit these new vulnerabilities.
Join the discussion on PHP’s flaws on the OC3D Forums.
