AI-discovered PHP flaws trigger global race to secure websites
Critical weaknesses in PHP, a programming language underpinning widely used web platforms, have prompted emergency updates and warnings to take vulnerable systems offline if they cannot be patched.
Critical security flaws uncovered with the help of artificial intelligence have triggered an international effort to protect websites running PHP. The programming language’s developers released emergency updates on October 21, 2026, warning that the vulnerabilities could allow attackers to execute code remotely without logging in. PHP security advisory
PHP is an open-source, server-side scripting language used to support web applications and generate dynamic content. It works behind the scenes on web servers, rather than simply displaying information in a visitor’s browser. Its widespread use makes weaknesses in the language potentially consequential across many otherwise unrelated websites. NHS England alert
The vulnerabilities, collectively known as PHP2Shell, affect the underlying PHP engine rather than a single website or application. Security firm Wiz said it demonstrated attacks against deployments of WordPress, Drupal and Joomla. Secure application code alone therefore does not eliminate exposure when the PHP installation beneath it remains vulnerable. Wiz research
The two issues are tracked as CVE-2026-109618 and CVE-2026-109619, each carrying a severity score of 9.2. They involve problems with memory handling and internal state during web-request processing. PHP’s developers say all installations serving web requests are at risk, although the practical exposure varies by configuration. PHP security advisory
Successful exploitation could allow an attacker to run code on an affected server or retrieve sensitive information from its memory. NHS England’s security alert says researchers have demonstrated remote code execution in products integrating PHP. Those demonstrations establish a technical risk, but do not by themselves show that every vulnerable website has been attacked. NHS England alert
AI’s role was to make exceptionally complex research more practical, according to Wiz. The company said the underlying weaknesses had existed for more than a decade, while advanced models helped researchers develop and adapt working exploits across applications in hours. Its account highlights how improved research tools can change the exploitability of old software defects. Wiz research
That creates a double-edged security challenge: the same capabilities that help defenders investigate weaknesses may also reduce the effort attackers need to exploit them. Wiz said the response involved coordination with PHP’s developers, Calif, OpenAI and infrastructure providers. Their work included checking patches and preparing protections before public disclosure. Wiz research
PHP released fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, urging users to update immediately. Organisations receiving PHP through operating-system or hosting vendors should check for the corresponding updated packages. Older installations require particular attention because PHP 8.1 and earlier no longer receive normal updates from the project. PHP security advisory
The immediate priority is deploying fixes rather than relying on temporary protections. NHS England assesses future exploitation as highly likely and advises affected organisations unable to patch immediately to assess their risk and consider taking vulnerable systems offline. Its guidance says updating to a patched PHP release is the only complete remediation. NHS England alert
Sources
Primary source: BBC Technology. Newzly rewrites and structures source reporting for clarity; verify critical details at the original.