Two newly disclosed critical vulnerabilities in PHP have turned a long-running piece of internet plumbing into an urgent security story. PHP is the server-side scripting language behind a vast share of the web, including many WordPress sites and custom applications. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, can allow remote code execution and carry a severity rating of 9.2 out of 10. Emergency updates were released quickly, but the race to patch has been complicated by a new reality: AI tools are helping researchers find and weaponize deep software flaws faster than ever.

The headline is simple: if you run a PHP-based website, confirm that it is on a patched version and check for signs of compromise. If you are a visitor, you do not need to panic, but you should keep your browser and security software current and maintain backups of data you store online. The larger story is about scale and speed. PHP is everywhere, and the time between disclosure and exploitation is shrinking.

Key facts at a glance

• PHP powers a large portion of server-side web traffic; industry surveys estimate nearly 70 percent of sites that use a server-side language rely on PHP.
• WordPress, a major PHP adopter, is used by roughly 40 percent of all websites.
• The two critical vulnerabilities were announced on October 20, 2026, and patched in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
• Both flaws allow remote code execution and affect all PHP installations serving web requests, according to the maintainers.
• Security researchers built a single exploit script, dubbed PHP2Shell, with help from frontier AI models.
• Attack attempts escalated rapidly; one major content delivery network reported blocking millions of exploit attempts by the evening of October 21.
• Researchers also found evidence of probing as early as October 17, four days before emergency patches landed.

What is PHP?

PHP is a general-purpose scripting language that is especially common in web development. It runs on a server and lets a website perform complex tasks without embedding every instruction directly into each page. That is why PHP is often called a server-side language. When a visitor requests a page, the server can use PHP to generate output dynamically: the current date, HTML pages, PDF documents, JSON responses, XML files for caching, and many other kinds of content. The visitor sees the result, not the code that produced it.

That role makes PHP part of the invisible infrastructure of the internet. Many content management systems, forums, e-commerce platforms, and custom applications depend on it. Its long history is both a strength and a risk. The language is mature, widely documented, and supported by a large ecosystem. But mature software also carries decades of code paths, integrations, and deployments. When a critical flaw appears in a core component, the blast radius can be enormous.

Why did PHP suddenly become a headline?

On October 20, 2026, the PHP maintainers released an alert for forthcoming security updates designed to patch two very high-risk vulnerabilities. The flaws were later named CVE-2026-109618 and CVE-2026-109619. Both enable an attacker to run remote code, both carry a severity rating of 9.2 out of 10, and both affect all PHP installations serving web requests, according to the maintainers. The existence of the flaws was known previously, but they were assumed to be too difficult to exploit in practice.

That assumption changed when researchers at the cybersecurity firm Wiz found a way to exploit them through a single script. The script was dubbed PHP2Shell and was developed in partnership with teams at Calif and OpenAI. The advisory set off a scramble across the web. Server administrators prepared for patched versions of PHP. When details of the two vulnerabilities were released the next day, October 21, sites began going offline temporarily as upgrades were completed. Government websites in the Netherlands, France, and Germany were among those affected.

Why the scale matters

There are two main reasons this became a major security event: the number of affected sites and the speed at which vulnerabilities can now be exploited. In theory, if left unpatched, more than half the internet could have been at risk. That is not a small niche. PHP is used by popular platforms, small business sites, government portals, hobby projects, and internal tools. Many site owners do not manage their servers directly. They rely on hosting providers, agencies, or plug-in ecosystems. That layered responsibility can make patching faster in some cases and slower in others.

The second reason is speed. In the pre-AI era, a vulnerability could take days, weeks, or even months before a working exploit appeared. Attack campaigns also spread more slowly. Discovery often took longer. AI has changed that calculus. It did not just accelerate the threat; it helped researchers uncover these vulnerabilities in the first place. That is the double-edged sword at the center of the story. AI can help defenders find dangerous bugs before attackers do, but it can also lower the time and expertise needed to turn obscure flaws into working attacks.

How AI changed both discovery and exploitation

Researchers at Wiz used frontier AI models, including Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol, while uncovering the flaws and developing working exploits. According to Wiz, AI helped turn vulnerabilities that had lurked in PHP for more than a decade into something a single researcher could exploit in a week. The firm estimates that the same task could previously have taken a world-class security team months. That does not mean every attacker can now find zero-days in a week. It does mean the barrier to entry is falling, and the window between patch and exploit is compressing.

For defenders, the lesson is not that AI is inherently dangerous. The lesson is that security teams need to assume faster exploitation. A patch that would once have bought a week of breathing room may now buy hours or days. Emergency maintenance windows, firewall rules, and monitoring all matter more when exploit development is assisted by automation. The same tools that help researchers understand a bug can help attackers iterate on bypasses. The result is a faster cycle of action and reaction.

What has happened since the disclosure?

Since the announcement of the critical flaws, services have erected firewalls and other defenses to block exploit attempts. One of the biggest content delivery networks reported blocking millions of attempted exploits by the evening of October 21. Its chief executive said the numbers began spiking as soon as the flaw disclosures went live. But those defenses are not impenetrable. Coverage does not extend to all corners of the internet. The same content delivery network is used by only about 21 percent of all websites, so many sites rely on other protections or none at all. Attackers also continue to adapt their techniques to slip past defenses, rapidly iterating with the help of AI.

By October 22, the picture had become more urgent. Cloudflare had spotted millions of attempts to exploit the vulnerabilities. Amazon’s security researchers detected signs of attackers probing the flaws as early as October 17, four days before emergency patches landed. Hackers were reportedly tweaking their attacks to slip past defenses. The practical takeaway is blunt: if you run a website using PHP, patch it now. Do not assume you are in the clear just because you have not noticed anything suspicious. Amazon recommends checking for signs of compromise dating back to October 17.

Which PHP updates include the security patches?

The PHP maintainers have directly issued patches within versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. If a website relies on an older version, it must receive the necessary security fixes through a vendor that helps maintain that older version. Older branches may not receive direct updates from the core project, which is why long-term support arrangements matter. A site that is technically “still working” may be running unsupported code with no path to a patch. That is a risk even outside this specific incident.

Site owners should check both the PHP version and the patch level. It is not enough to know that a host offers PHP 8.3 or 8.4. The specific patch release matters. Managed hosting providers may upgrade automatically, but customers should verify rather than assume. Self-managed servers, containers, NAS devices, and hobby boards need manual attention. If a site depends on a custom application, the application’s vendor or maintainer should confirm compatibility with the patched PHP release.

How will visitors be affected?

Some websites may go offline or remain offline until they are running a secure version of PHP. But by the afternoon in the United States, many sites were operating normally. Most visitors should be able to browse as usual. The more important impact is indirect. An unpatched website could be attacked and used to run remote code. That means it could spread malware, steal data from the server, or delete data on the server. Visitors cannot patch someone else’s server, but they can reduce their own exposure.

Standard advice still applies. Keep your browser and antivirus software up to date. Be careful about the information you share with websites. If you store data on a site, ensure you have backups of that data in case the site is compromised or taken offline. These steps are not specific to PHP, but they are useful when a large piece of web infrastructure is under active attack.

What should website owners do?

If you manage a website using PHP, verify that it is updated to one of the patched versions. You may not need to do anything yourself. Some consumer web hosts are quietly handling the work in the background. In one case, a volunteer group’s WordPress site had already been upgraded to 8.3.36, and the support team said it was globally applying updates and had configured its firewall to block exploit attempts. That is the ideal outcome. But it is not universal. The responsible move is to check.

For those running PHP as part of a NAS, Raspberry Pi, or other home or small-office setup, put on your server administrator hat and ensure a proper update. Check the package manager, the vendor’s firmware update channel, or the application’s documented upgrade path. After patching, review logs for unusual activity. Look for unexpected outbound connections, new files, changed permissions, or unexplained administrative actions. If compromise is suspected, isolate the system, preserve evidence, and follow the vendor’s incident response guidance.

How to check a WordPress site’s PHP version

Your web host may show the full details of your PHP version in the general management dashboard. If not, check within the WordPress admin dashboard. In the left-hand navigation bar, look for Tools, then choose Site Health. You will see two tabs in the main part of the screen. Select Info, then choose the Server section. A drop-down screen should reveal your PHP version. Confirm that it matches one of the patched releases or that your host has applied an equivalent vendor fix.

Source:PCWorld News