Global Internet Alert After Discovery of Two Critical Vulnerabilities
Two critical vulnerabilities in PHP, a programming language widely used on the Web, have prompted European government institutions and hospitals to take websites offline as a precaution, amid warnings that the flaws could be exploited to compromise servers.
Efforts have accelerated worldwide to fix two critical security vulnerabilities in the PHP programming language. Cybersecurity bodies warned that the flaws could allow remote code execution and the takeover of vulnerable servers, prompting government institutions, hospitals and organisations to take websites offline as a precaution.
In a report published on Wednesday, The Washington Post said the flaws affect technology used by as many as 70% of websites. Their discovery with the help of artificial intelligence has raised concerns that attackers could rapidly develop exploits before organisations can update their systems.
The two vulnerabilities, collectively known as “php2shell”, concern memory handling and internal request-state management in PHP, an open-source programming language used to power the server-side functions of websites and web applications. They could allow an attacker to execute code on a vulnerable server without logging in, potentially enabling data theft, data modification or service disruption.
Both vulnerabilities were classified as critical and assigned a severity score of 9.2 out of 10 under version 4 of the Common Vulnerability Scoring System, or CVSS. They carry the identifiers CVE-2026-109618 and CVE-2026-109619.
Researchers at cybersecurity company Calif discovered the first flaw with the help of an advanced AI model, as part of an OpenAI-led initiative to use the technology to identify software vulnerabilities. The company said researchers at Wiz had also independently discovered and reported both flaws.
According to The Washington Post, researchers began notifying the relevant parties in August, allowing PHP developers and cybersecurity companies to coordinate their response and prepare fixes before the public disclosure on 21 October.
OpenAI said the incident demonstrated the ability of advanced models to uncover flaws that could affect a substantial portion of the internet. It also warned, however, that the same capabilities could help attackers rapidly develop offensive tools. The company added that it was working to fix other significant vulnerabilities discovered during security research.
As part of the response, developers released urgent security updates for supported PHP versions. The European Union Agency for Cybersecurity, the European Commission and other European bodies stressed the need to identify vulnerable systems and update them immediately, prioritising internet-facing servers and applications.
Cybersecurity bodies urged organisations unable to install the fixes immediately to isolate vulnerable applications temporarily from public networks.
They also recommended reviewing server, application and authentication logs, and checking for unusual processes, files, accounts or outbound connections that could indicate an earlier compromise.
In Belgium, the Foreign Ministry took its websites offline following reports of attacks exploiting the vulnerabilities. The Centre for Cybersecurity Belgium, however, said it had recorded no attacks against Belgian websites. In the Netherlands, precautionary measures affected government websites, hospitals, the Port of Rotterdam, the national football association and the websites of the five largest political parties.
In Finland, the government’s information technology centre suspended public web services as a precaution, saying it had detected no attempts to exploit the vulnerabilities and that the shutdown was not caused by a data breach. The Czech government also disabled its website on the cybersecurity authority’s recommendation pending the installation of the necessary updates.
The Wikimedia Foundation, which operates Wikipedia, said it was addressing the vulnerabilities in systems using PHP and had taken several other systems offline as a precaution until they could be secured.
Cloudflare, meanwhile, announced that it had prepared and deployed protections through its web application firewalls before the vulnerabilities were publicly disclosed, aiming to protect websites and help them remain operational.
WordPress urged website owners to update their systems immediately.
According to technical advisories, the issue affects PHP versions from 5.4 onwards across multiple runtime environments, including PHP-FPM, Apache with the mod_php module, php-cgi, FrankenPHP and LiteSpeed.
Cybersecurity bodies said the risk could be greater in mod_php environments, where an exploitation test showed that the flaw could be triggered before the application’s own code was executed.
Fixes were released in supported versions PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier versions no longer receive official security support from the PHP project, although some software distributions and long-term support providers may offer separate patches.
Cybersecurity bodies warned that the problem extends beyond websites whose operators know they use PHP. Commercial products, open-source software, content management systems and hosting services also rely on it behind the scenes. Applications such as WordPress, Drupal, Joomla and Magento could therefore be affected, depending on their versions and runtime environments.
Authorities recommend updating vulnerable systems to patched, supported versions; checking software, devices and services that may contain PHP components; isolating systems that cannot be patched immediately; and reviewing logs for indicators of compromise. If evidence of prior exploitation emerges, installing the update alone is not enough: the incident must be investigated and its effects contained.
The incident highlights a growing challenge for internet security: a single flaw in widely used technology can require a simultaneous response from organisations with no direct connection to one another. It also underscores the race between defenders and attackers to harness AI, which can accelerate vulnerability discovery but may also speed up the development of exploits.
PHP’s widespread use does not mean that an equivalent proportion of websites has been breached, or that every vulnerable system has actually been exploited. Rapid patch deployment and the identification of outdated or overlooked systems nevertheless remain decisive in narrowing the window of opportunity for attackers and preventing a software flaw from becoming a large-scale compromise.
