PHP vulnerabilities threaten 70% of websites, researchers say

Two Critical Flaws Threaten Seventy Percent of Global Websites

Security researchers discovered two critical vulnerabilities in the core of PHP, a programming language that underpins approximately 70 percent of all websites on the internet. Tracked as CVE-2026-109618 and CVE-2026-109619 and collectively known as php2shell, the flaws allow unauthenticated remote code execution on affected servers. OpenAI characterized the bug as one of the most impactful vulnerabilities in recent memory, while Wiz Research called the language the backbone of the web.

Artificial Intelligence Unlocks Decades-Old Flaws

The vulnerabilities had been present in PHP code for decades before automated frontier models lowered the barrier to exploitation. Wiz Research stated that demonstrating the exploitability of these flaws required an exceptionally complex chain of steps at the edge of what human researchers could practically achieve. Using tools including OpenAI technology and Gemini 4 Argon, researchers successfully chained multiple flaws and adapted to targets’ memory layouts within hours.

Governments and Companies Race to Apply Patches

Organizations worldwide rushed to update software as threat actors targeted the flaws shortly after disclosure. Cloudflare reported that its organization observed attack traffic targeting its customers. The U.K. National Cyber Security Center called for immediate action to update systems.

Digital Service Disruptions Spread Across Europe

Public sector digital infrastructure experienced immediate fallout as governments took services offline to prevent breaches. Dozens of British and Finnish government services were temporarily taken down, alongside local government sites in France. In Latvia, authorities restricted access to digital services and shut down several municipal websites to secure information systems against potential unauthorized access.

Frequently Asked Questions About php2shell

What specific software versions are affected by php2shell?

The vulnerabilities involve how PHP handles memory parsing during RFC1867 multipart requests. The PHP Foundation has released two patches designed to fix CVE-2026-109618 and CVE-2026-109619.

How quickly did security firms deploy defenses against the exploit?

Cloudflare deployed web application firewall protections approximately nine hours ahead of public disclosure, protecting its customers starting at 3:02 a.m. UTC on October 21, 2026.

What emergency measures did national leaders recommend?

The U.K.’s National Cyber Security Center called on organizations to “take immediate action” to update their websites to the latest fixed or patched version.

More on this story: PHP flaw leads to millions of exploit attempts globally · PHP Prepares Emergency Patches for Critical RCE Flaws After Leak