The two flaws, uncovered with the help of artificial intelligence after hiding in PHP's code for more than a decade, can let an attacker seize control of a website without any password at all. PHP's developers rushed out emergency fixes on Wednesday, governments across Europe pulled official sites offline as a precaution, and the White House said the Trump administration was coordinating the response with federal agencies and leading AI labs.
PHP's developers released emergency updates on Wednesday for two critical vulnerabilities and told every user of the software to install them at once. "All PHP users are strongly encouraged to update immediately," the developers said in a security advisory about the new versions, which fix the flaws tracked as CVE-2026-109618 and CVE-2026-109619. Both flaws could allow hackers to execute malicious code on a website and potentially take control of it, Cybersecurity Dive reported.
PHP is the programming language that runs much of the web from behind the scenes: when a visitor loads a page, the server running PHP assembles the content and sends the finished page to the browser. It is free, open-source and maintained by volunteers. According to web technology tracker W3Techs, PHP runs roughly 70% of all websites whose programming language can be identified — one Reuters report put the figure nearer 75% — and it is the engine behind WordPress, the software that powers about 40% of all websites, from blogs and small businesses to government portals and online shops.
The two vulnerabilities are rated 9.2 out of 10 on the industry's CVSS severity scale. CERT-EU, the European Union's cybersecurity response team, said that rating signals unauthenticated remote code execution: an attacker can run commands on a vulnerable server over the internet with no password or account. The flaws sit in how PHP handles errors when a request is too large for its memory; internet infrastructure firm Cloudflare explained that by manipulating the data left in that invalid memory, "an attacker may be able to crash a PHP process, expose sensitive information, or execute code provided by the attacker." Whoever exploits the flaw controls the website — which hosting provider GoDaddy said could mean stolen data, defaced pages or full-system compromise.
"These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history."
Estimates of the exposed pool differ sharply. One researcher put the number of vulnerable websites at more than 1.3 million, while security firm Palo Alto Networks counted more than 22.6 million exposed instances. Cisco estimated that roughly half of internet-facing PHP installations are running versions too old to receive the fixes at all. "All servers using any version of PHP released in the last 20 years will be vulnerable," said Tiffany Farriss, interim chief executive of the Drupal Association. "This issue impacts the majority of the Internet."
Governments moved first. Cybersecurity agencies in the United States, the United Kingdom, Canada, Australia and the European Union urged website operators to take their sites offline until their PHP versions could be updated, and CERT-EU's guidance was to take affected sites down rather than leave them exposed. Finland's state IT provider took government public network services offline "as a precautionary measure," the Dutch National Cyber Security Centre disconnected its own sites, the Dutch House of Representatives went dark, and France's Interior Ministry placed all of its websites into preventive maintenance. The operator of Wikipedia said it had taken down an unspecified number of systems until they could be safely patched, and Japan's Prime Minister Sanae Takaichi posted on X urging website owners to "check whether your live site uses PHP and prepare to apply the new fix." The National Security Agency urged its partners to update their websites as soon as possible, warning: "These vulnerabilities often provide a direct path to the server's file system or database."
The race is already on. "There are already reports of exploits in the wild," security researcher Nicholas Weaver told Cybersecurity Dive, "which means systems which aren't up to date are incredibly vulnerable." Threat experts at watchTowr and Sophos said they were seeing discussion and attempted exploitation in cybercriminal communities, and Costin Raiu of research firm TLP:Black said AI was powering a "race to exploit," warning the next step could be the "mass compromise of every vulnerable web server on the internet." The danger is sharpest for small websites run by owners with no security staff, often on shared hosting where they do not manage the server — and Wordfence, a security plugin for WordPress sites, warned that the usual automatic updates will not apply this fix.
The flaws themselves were found by machines. Researchers at Wiz, the Google-owned security firm that called them among the most severe ever found in PHP, said the vulnerabilities had remained hidden in the code for more than a decade and would have been extraordinarily complicated for a human to exploit. Wiz said its research used its autonomous AI research tool alongside Google and OpenAI models. Security firm Calif found the flaws using OpenAI's GPT-5.6 Sol model; Calif reported the first flaw to PHP on August 11 and Wiz reported a second on August 24. "Given the severity of these flaws and PHP's widespread use, we consider this one of the most impactful security issues in recent memory," OpenAI said in a statement. "It highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits."
The White House said the U.S. government learned about the vulnerabilities on October 16, and that federal agencies were assessing their own use of PHP and working with critical infrastructure operators to help them apply the patches. "The Administration is tracking and coordinating with federal agencies and leading [AI] labs to expedite the release of the fix and protect American networks and critical infrastructure," the White House said. It framed the AI-assisted discovery as a national-security argument for American technology leadership: "This discovery demonstrates exactly why American leadership in SI is so critical," the White House said, using President Trump's preferred term — Super Intelligence — for artificial intelligence. "This is American innovation strengthening our national security." For the millions of sites that have not patched yet, Weaver's warning is the bottom line: "One thing AI systems are really good at is turning a patch into an exploit, since a patch is a recipe for 'what has changed.' We are in the world where you have to apply updates effectively instantly."