Two critical vulnerabilities in PHP – the server-side language behind much of the public web – allow unauthenticated remote code execution (RCE) on affected servers. Emergency patches landed on Wednesday 21 October, but they cover only PHP 8.2 and newer, leaving a long tail of older sites exposed.
The UK’s National Cyber Security Centre (NCSC) described a vulnerability that would allow an attacker to trigger an out-of-memory condition that corrupts memory and, under certain conditions, achieve unauthenticated remote code execution. In other words, the attacker gets a shell on the server and a direct path to the file system and the database.
PHP is a free, open-source, server-side scripting language created in 1994. It runs on the web server, not in the browser, to assemble page content, talk to databases and run backend logic before delivering finished HTML to a user. It sits beneath the content-management and e-commerce systems most organisations rely on, which is why the blast radius is so wide.
The two flaws – CVE-2026-109618 and CVE-2026-109619 – each carry a severity rating of 9.2 out of 10 and affect every release dating back to PHP 5 in 2004. PHP powers roughly 24 million websites, according to BuiltWith, and about three-quarters of all sites whose language can be identified, according to W3Techs.
The vulnerabilities went undetected for more than a decade and were found using artificial intelligence (AI). Security firms Wiz and Calif used OpenAI’s GPT-5.6 Sol and Google’s Gemini 4 Argon to locate and verify them, coordinating with the PHP team before disclosure.
Official bodies around the world told organisations to act immediately. “Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated,” the UK’s NCSC said.
The US National Security Agency (NSA) warned: “These vulnerabilities often provide a direct path to the server’s file system or database. If an immediate update is not feasible, it is recommended that organisations take the system offline.”
The EU’s CERT-EU offered similar advice, telling operators to “consider isolating internet-facing applications from public networks until a fix can be applied” where remediation could not happen at once.
The impact was immediate and global. Finland’s state IT provider Valtori took government public services offline “as a precautionary measure”. In the Netherlands, the National Cyber Security Centre pulled its own site, alongside the Port of Rotterdam, the Overheid.nl portal, the KNVB football association and several hospitals. France’s Interior Ministry placed all its sites into preventive maintenance, Denmark’s Kombit shut down several services, and in the UK, Edinburgh Council and several BBC programme pages went dark.
Wikipedia, operated by the Wikimedia Foundation, said it had taken down an unspecified number of systems until they could be patched.
On Reddit’s r/PHP and r/technology forums, practitioners flagged the practical realities of the fix. Administrators running older PHP 7.x sites – a large share of the WordPress estate – reported waiting on backported fixes from Linux distributions, while others noted cloud platforms such as AWS Elastic Beanstalk had yet to ship the update. Several argued the long tail of unmanaged sites would take months to patch.
Timeline
-
Early August 2026 – a security researcher first flags the issue
-
Friday 16 October – the White House says it was first made aware of the flaw
-
20 October – PHP maintainers publish an advisory for two 9.2-severity vulnerabilities, with patches scheduled about 12 hours later
-
20–21 October – purported exploit details and a “PHP2Shell” video leak, showing remote code execution on WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symfony, Drupal and WHMCS
-
Wednesday 21 October, 13:34 UTC – source fixes land in the php-src GitHub repository and patches begin rolling out
-
Wednesday 21 October – NCSC, NSA, CERT-EU and agencies in Australia and Japan urge patching or takedowns; Finland, the Netherlands, France and Denmark take sites offline
