Two critical vulnerabilities in the programming language PHP prompted emergency security warnings and temporary website shutdowns Wednesday, as developers released updates to prevent attackers from gaining unauthorized access to servers and sensitive information.
By yourNEWS Media Newsroom
Government agencies and businesses across Europe and the United States rushed to secure their websites Wednesday, Oct. 21, after researchers using artificial intelligence helped identify two critical vulnerabilities in PHP, a widely used programming language that supports millions of websites and online services.
The security flaws could allow attackers to execute malicious code remotely on vulnerable servers without first obtaining authorized access. Such attacks could expose sensitive records, compromise databases or give intruders control over systems used by governments, businesses and other organizations.
The FBI’s cyber division warned operators to install security updates immediately or temporarily take affected websites offline if patches could not be applied. Similar alerts from American and European cybersecurity agencies prompted precautionary shutdowns as administrators assessed their systems.
The vulnerabilities affect PHP, an open-source server-side programming language widely used to generate website content, process transactions and communicate with databases. PHP supports platforms including WordPress, Drupal and Joomla, making flaws in its underlying software potentially consequential for a substantial portion of the internet.
According to Associated Press reporting on the coordinated security response, the discovery led governments and other organizations to interrupt public access to some websites while installing protections against possible attacks.
Finland was among the countries experiencing disruptions. The Finnish government’s website was only partially accessible Wednesday, with visitors informed that public services were experiencing temporary technical interruptions.
Finland’s Government ICT Centre, known as Valtori, confirmed that websites were being taken offline as a precaution because of the PHP vulnerabilities. The shutdowns affected several government services, including the National Land Survey’s website, according to Finnish public broadcaster Yle. <Cite ref=”turn740916search5″/>
The interruptions did not necessarily mean those websites had been compromised. In many cases, operators removed services from public access to prevent exploitation while preparing software updates.
The PHP Foundation confirmed Wednesday that security patches had been released for two vulnerabilities designated CVE-2026-109618 and CVE-2026-109619.
Both received severity scores of 9.2 out of 10 under the Common Vulnerability Scoring System, placing them in the critical category.
The Foundation’s October 21 security announcement identified PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as the updated releases addressing the flaws.
The developers warned that, under certain conditions, an attacker without a username or password could exploit the vulnerabilities to execute code directly on a server.
The first vulnerability, CVE-2026-109618, involves an error in how PHP manages memory when a request reaches an application-defined memory limit. Under particular conditions, internal information that has not been properly initialized can be treated as valid, resulting in memory corruption.
Researchers demonstrated that the flaw could permit remote code execution on certain Apache web server configurations before normal application code even begins running.
The second vulnerability, CVE-2026-109619, involves PHP retaining references to memory after an error occurs. When that memory is subsequently reused, an attacker may be able to trigger unintended behavior, including execution of unauthorized code.
Both issues involve core PHP operations rather than vulnerabilities confined to one website or application.
That distinction significantly broadens their potential impact. Even a website whose own programming is secure could remain exposed if the underlying PHP installation contains the affected code.
The official PHP security advisory urged all users to update immediately, identifying web servers running PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed among the potentially affected configurations. Developers said updating the software is the only reliable way to address the vulnerabilities completely. <Cite ref=”turn740916search2″/>
The scale of the concern reflects PHP’s extensive use across government services, online retailers, banks, media organizations and other businesses.
Ismael Valenzuela, vice president of labs, threat research and intelligence at cybersecurity company Arctic Wolf, estimated that PHP powers approximately 70% of websites whose server-side programming language can be identified.
“The potential impact is enormous,” Valenzuela said.
He warned that the vulnerabilities expose a “significant portion of the internet’s business and commercial infrastructure at potential risk,” although that does not establish that every PHP-powered website is vulnerable to successful exploitation.
Differences in software versions, server configurations, security controls and the way applications handle incoming requests can influence whether a particular system can be attacked.
Nevertheless, cybersecurity authorities treated the vulnerabilities as urgent because of their potential to provide access to sensitive systems without requiring attackers to compromise legitimate user credentials.
The U.S. National Security Agency issued an October 21 advisory instructing organizations to prepare immediate updates. The agency cautioned that the vulnerabilities could provide direct access to server file systems or databases and recommended taking systems offline when timely patching was not possible. <Cite ref=”turn740916search3″/>
Britain’s National Cyber Security Centre issued similar guidance, recommending that organizations identify every PHP installation within their infrastructure and prioritize systems accessible from the internet.
The British cybersecurity warning also advised administrators to monitor exposed systems for suspicious activity, install the relevant updates and check whether third-party software packages include affected PHP components. <Cite ref=”turn740916search4″/>
The emergency response followed a coordinated research effort involving the PHP Foundation, independent cybersecurity firms and artificial intelligence developers.
OpenAI said its researchers had worked with the PHP maintainers and security companies including Wiz and Cloudflare over approximately two months to prepare fixes and protective measures before the vulnerabilities became publicly known.
In an October 21 announcement detailing the research effort, OpenAI described the project as an example of how advanced AI systems can help security specialists identify complex software weaknesses.
The company said an AI-assisted researcher working through its Patch the Planet initiative identified a critical flaw, while Wiz independently discovered and reported the vulnerabilities.
“PHP’s maintainers led the fixes and release, with our teams and partners like Wiz, Cloudflare, and others contributing research, technical support, and coordination to prepare protections ahead of disclosure,” OpenAI said.
The company characterized the flaws as “one of the most impactful security issues in recent memory,” pointing to the language’s extensive use and the potential consequences of unauthorized server access.
OpenAI also said AI-assisted research appeared to identify the vulnerabilities before malicious actors were known to have exploited them.
“As significant as they are, these bugs are among several significant vulnerabilities we’ve already found and are working to fix, and we expect similar findings to increase sharply in the coming months,” the company stated.
The PHP Foundation’s account provided additional context about the vulnerabilities’ history.
Developers acknowledged that the underlying memory-management problem associated with one flaw had first been identified during security work in 2024. At the time, researchers had not established a practical method for exploiting it remotely, and efforts to develop a suitable fix stalled because of technical difficulties.
The Foundation described the delay as a structural failure involving limited resources and difficulties reaching agreement on changes to core PHP functions.
The situation changed in August 2026 when researchers working with the security firm Calif and OpenAI independently reported ways the weakness could lead to remote code execution.
Additional findings from Wiz and other researchers reinforced the severity of the problem, prompting the PHP development team to prioritize a fix.
The vulnerabilities were particularly difficult to address because they affected fundamental aspects of PHP’s memory management and error handling. Changes to those functions risked breaking compatibility with software extensions and applications used across the internet.
Developers ultimately prepared fixes for the currently supported PHP branches while coordinating with software distributors and hosting providers.
The planned disclosure process encountered problems shortly before the updates became available.
According to the PHP Foundation, the vulnerability identifiers began circulating online Tuesday, Oct. 20, accompanied by incorrect information about the severity score and intended release time.
The PHP project accelerated its public announcement and moved the security release forward by one day, from Thursday to Wednesday.
A researcher associated with Calif also mistakenly published a video demonstrating an exploit against test systems. Although the video was removed, copies circulated online and contributed to the development of additional demonstrations of how the vulnerabilities might be exploited.
The Foundation reported that another software distributor released updated software images before the agreed disclosure deadline, potentially allowing attackers to examine the changes before all affected organizations could obtain the fixes.
Those developments complicated the attempt to give defenders enough time to prepare without exposing technical details that could accelerate attacks.
In its statement, the PHP security team said it had examined publicly circulating demonstrations but had not identified a functional exploit at the precise time of the coordinated release.
That assessment did not eliminate the possibility that attackers could develop working exploits after examining the patches and newly available technical details.
The discovery illustrates how artificial intelligence is changing the speed of cybersecurity research.
Advanced AI tools can analyze large codebases, identify unusual programming behavior and help researchers investigate possible vulnerabilities that might otherwise require lengthy manual examination.
They may also assist attackers by reducing the effort needed to identify weaknesses, understand security patches or adapt publicly available exploit techniques.
The same capabilities that allow defenders to uncover hidden flaws can therefore shorten the period between disclosure and attempted exploitation.
Raghu Nandakumara, vice president of industry strategy at cybersecurity company Illumio, described the challenge as a balance between faster discovery and effective operational safeguards.
“There’s an important paradox here. We want AI to move quickly enough to find vulnerabilities humans might miss, while also making sure that increasingly autonomous systems operate within boundaries we understand and control,” Nandakumara said.
“The faster AI becomes at finding weaknesses, the more important it becomes to think about what happens after those weaknesses are exposed, especially when organizations can’t immediately patch every affected system,” he added.
“The lesson isn’t that AI is inherently dangerous or inherently protective. It’s that speed without control creates a new kind of security problem.”
Valenzuela similarly noted that AI advances have altered how security researchers assess weaknesses that were previously considered difficult to exploit.
Some of the underlying programming problems had existed for years, but automated analysis and improved testing capabilities made it easier to determine how they could be turned into practical attacks.
“What changed wasn’t the underlying code, but the ability to find those weaknesses and turn them into working exploits,” he said.
The incident follows growing concern about the ability of increasingly autonomous AI systems to interact with external tools, software infrastructure and sensitive data.
Previous security incidents involving AI systems have raised questions about unauthorized access, manipulation of automated tools and the safeguards needed when software can perform complicated tasks without continuous human supervision.
An earlier Associated Press report examining AI-related security weaknesses described how researchers were investigating new forms of cyber risk as the technology becomes more widely integrated into online services.
The PHP vulnerabilities demonstrate a different aspect of the same technological development: AI can also serve as a defensive tool by identifying serious weaknesses before they become widely exploited.
However, the protective value of early discovery depends on whether developers can produce patches and whether organizations install them promptly.
For website operators, the immediate concern is determining whether their servers run affected PHP versions.
Organizations may operate PHP through their own servers, commercial hosting providers or software platforms that manage underlying infrastructure on their behalf.
Applying the security updates may therefore require coordination with hosting companies, system administrators and developers responsible for maintaining web applications.
The fact that a website uses a platform such as WordPress does not necessarily indicate that its operator must personally install PHP patches. In managed environments, the hosting provider may control the server software and deploy the required updates.
Operators are nevertheless responsible for verifying that their systems have been secured.
The PHP Foundation has warned that temporary workarounds cannot fully eliminate the risks associated with the two vulnerabilities. Updating to an appropriate fixed release remains the recommended protection.
The incident also highlights the importance of maintaining supported software versions. Organizations using outdated PHP installations may face additional challenges because older versions do not necessarily receive the same security updates as currently supported branches.
Such systems may require upgrades or replacement before the newly disclosed vulnerabilities can be reliably addressed.
For governments and businesses that temporarily took websites offline Wednesday, restoring services will depend on confirming that the necessary security changes have been applied and that systems are functioning properly.
The emergency shutdowns reflect the consequences of vulnerabilities affecting software components used by large numbers of unrelated organizations.
A security problem in a common programming language can expose systems across numerous industries and countries, even when those organizations have no direct operational relationship.
The PHP Foundation said the incident has reinforced the need for greater investment in open-source security, including more developers with expertise in the language’s core functions.
It has also begun changing internal procedures so that difficult security decisions can be resolved more quickly when researchers identify serious weaknesses.
As of Wednesday, fixed PHP releases were available, and cybersecurity agencies continued urging organizations to install them immediately.
The response will depend on the speed of updates across hosting providers, government agencies and businesses, particularly those operating older systems or infrastructure that cannot easily be taken offline.
The discovery has demonstrated both the defensive value of artificial intelligence-assisted security research and the operational challenges created when serious vulnerabilities are found in software supporting a substantial portion of the internet.
Comments