The vulnerabilities, catalogued as CVE-2026-109618 and CVE-2026-109619, were uncovered by researchers at cybersecurity firms Calif and Wiz using OpenAI's frontier AI models as part of the Patch the Planet initiative. OpenAI described the discovery as 'one of the most impactful security issues in recent memory.' Wiz said the flaws had gone undetected for more than a decade and that 'frontier models were critical to making this process practical, enabling us to develop and adapt working exploits across multiple applications in hours.'
The PHP Foundation initially planned to release the fix later in October, but details leaked on the Hacker News forum on Tuesday, forcing an early announcement and patch release. Cloudflare reported seeing attacks hours before the patch shipped, with CTO Dane Knecht posting that they were 'seeing early attacks emerging and are updating mitigations as new vectors show up.'
Finland's state IT center, Valtori, began taking public web services offline as a precaution, while the Netherlands' national cybersecurity agency took down its own website. France also took government websites offline. The Wikimedia Foundation, which runs Wikipedia, said it 'took down a number of other systems as a precautionary measure until they can be safely patched.' Edinburgh Council's website became inaccessible, as did pages for BBC programmes including Doctor Who and The Traitors. The art platform DeviantArt went down for unspecified maintenance.
The US National Security Agency advised organizations to take systems offline if they could not immediately patch, writing on X that 'these vulnerabilities often provide a direct path to the server's file system or database.' The UK National Cyber Security Centre similarly urged organizations to 'consider taking the system offline until it can be fully mitigated.' Japan's Prime Minister Sanae Takaichi posted on X urging website owners to check if their sites use PHP and prepare to apply the fix.
Tiffany Farriss, interim chief executive of the Drupal Association, warned that 'all servers using any version of PHP released in the last 20 years will be vulnerable. This issue impacts the majority of the Internet.' The cybersecurity firm Huntress noted that PHP 'quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn't even advertise that it runs PHP under the hood.'
Costin Raiu, co-founder of firm TLP:Black, said the next step could be the 'mass compromise of every vulnerable web server on the internet.' Don Smith from Sophos' Counter Threat Unit told the BBC this would 'likely be a priority target for hackers,' adding that the immediate challenge is finding and managing every instance where PHP is running, as 'the use of PHP is pervasive' and can be hidden behind third-party products.
According to data from Censys, about 1.5 million out of 2.6 million hosts report running a version of PHP for which no official fix exists. The PHP Foundation has released patches for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and source-code patches for older versions 7.4, 8.0, and 8.1. Linux distributions are backporting fixes. Hosting providers including Wordfence and GoDaddy have warned customers. Regular users do not need to take action beyond updating software when prompted.
