A flaw in PHP puts millions of websites at risk

The team behind PHP, the programming language used to run a large part of the web, released emergency fixes on Wednesday, October 21, 2026, for two critical security flaws. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and each is rated 9.2 out of 10 on the CVSS severity scale. Researchers have nicknamed them "php2shell".

PHP runs an estimated 70 to 80% of websites whose server language is known, including sites built with WordPress, Drupal, Joomla and Laravel. According to researchers, the flaws could let an attacker run code on a web server and take control of it. More than 1.3 million servers connected to the internet could be affected.

The flaws were found with the help of artificial intelligence. The security firm Calif found one using an OpenAI model, and Wiz said it found several memory-safety bugs in PHP using AI tools from OpenAI, Google and its own. Wiz says AI makes complex bugs like these easier to exploit.

Security agencies, including CERT-EU and the UK's National Cyber Security Centre, urged organizations to update quickly, or to isolate their websites from the internet if they cannot update right away. At the time of the reports, the US agency CISA said it had not seen the flaws being used in attacks, while some firms reported attackers scanning the internet for servers that had not been fixed.

Many servers may stay exposed: about 758,000 servers that show their PHP version run older versions that no longer receive security updates.