Two critical security flaws in a programming language used by millions of websites have triggered an urgent cybersecurity response after researchers used artificial intelligence (AI) to identify weaknesses that could let attackers take control of vulnerable web servers.
The flaws affect PHP, a programming language used to build and run websites, including those based on platforms such as WordPress, Drupal and Joomla.
PHP developers released emergency security updates on Oct. 21 and urged users to install them immediately. They warned that the flaws could allow attackers to run malicious code on affected servers without logging in.
Cloudflare, a company that helps protect websites from cyberattacks, reported attack traffic targeting its customers after details of the flaws leaked before their planned public announcement. On Thursday, New Zealand's National Cyber Security Centre said it was aware of reports of active exploitation.
US, British, EU and Australian cybersecurity authorities have issued urgent warnings about the vulnerabilities, while some organizations temporarily took websites offline as a precaution.
The incident is also being seen as a turning point in cyber security: AI helped defenders identify vulnerabilities that had survived years of examination, but experts warn the same technology could help attackers exploit them much faster.
PHP, short for PHP: Hypertext Preprocessor, is an open-source programming language mainly used to run websites behind the scenes.
When someone visits a website, PHP can retrieve information from databases, process requests and prepare the content that appears on the user's screen.
It is used by platforms including WordPress, Drupal, Joomla and MediaWiki, the software behind Wikipedia.
W3Techs estimates that PHP is used by about 69% of websites whose server-side programming language it can identify.
Because PHP is so widely used, a security flaw in the language itself can affect many different websites, rather than just one application.
The two flaws are identified as CVE-2026-109618 and CVE-2026-109619. Google Cloud's technical analysis gives each a critical severity score of 9.2 out of 10.
Both involve how PHP handles computer memory when certain errors occur.
One vulnerability involves an out-of-memory condition that can leave internal request data partially initialized; the other involves internal state that can continue referencing memory after it has been freed.
Attackers could send specially designed requests to trigger these problems and potentially run their own code on an affected server without logging in.
If an attack succeeds, criminals could steal information, change website content or use the compromised server to attack other systems.
Because the flaws affect PHP itself, updating WordPress plugins or themes alone will not fix the problem. The underlying PHP software must also be updated.
Cybersecurity company Wiz said the flaws affect PHP versions dating back to version 5.4, released more than a decade ago.
Google Cloud's analysis identifies affected versions ranging from PHP 5.4 through 8.5.11.
Cloudflare also warned that servers using PHP 5.4 or later could be vulnerable.
However, that does not mean every PHP-powered website has been successfully compromised or that every configuration is equally easy to exploit.
PHP's developers said installations serving web requests are at risk and warned that some configurations are especially exposed.
The scale nevertheless prompted governments and major cyber-security agencies to treat the discovery as an emergency.
The US National Security Agency advised organizations to update affected systems and said those unable to do so immediately should consider taking them offline.
Britain's National Cyber Security Centre issued similar advice, while EU cyber-security bodies called for immediate patching, prioritizing internet-facing systems.
The PHP development team released four patched versions Wednesday: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
“All PHP users are strongly encouraged to update immediately,” the project said.
The developers warned there are “no complete mitigations,” meaning organizations cannot safely rely on temporary workarounds instead of installing the update.
Cloudflare said it had already deployed web application firewall protections before public disclosure.
Such measures can help block malicious requests but do not replace patching the underlying software.
Researchers at cybersecurity companies Calif and Wiz used AI tools to examine PHP's code and identify potential security weaknesses.
OpenAI said Calif identified a critical flaw using its GPT-5.6 Sol model as part of a security initiative. Wiz independently discovered the vulnerabilities using several AI tools.
The underlying coding errors had existed for years. However, showing how they could be used in a real attack required detailed technical work and specialist knowledge.
Wiz said AI reduced the time and effort needed for this process. According to the company, one researcher completed work in about a week that could previously have taken a specialized team months.
OpenAI described the PHP discovery as “one of the most impactful security issues in recent memory.”
The same capabilities that allow AI to search millions of lines of computer code for hidden weaknesses can potentially be used by attackers.
Once information about a vulnerability becomes public, AI systems could help malicious actors understand it, write exploit code and adapt attacks against different targets considerably faster than before.
That could shorten what cyber-security researchers call the defender's window — the period between discovering and fixing a vulnerability and widespread attempts to exploit it.
In this case, researchers and PHP developers coordinated privately for weeks before publicly disclosing the flaws so protective measures could be prepared.
But the details leaked shortly before the planned announcement.
Cloudflare said it subsequently detected attackers changing their techniques in attempts to bypass protections.
For organizations operating PHP systems, the advice from authorities is straightforward: identify PHP installations and update them immediately to a patched version.
Operators should prioritize systems exposed directly to the internet and monitor them for signs that attackers may already have gained access.
Organizations that cannot patch immediately have been advised to consider temporarily taking vulnerable services offline.
For ordinary internet users, there is little that can be done to fix the PHP vulnerability directly because responsibility rests with website operators and hosting providers.
Users should nevertheless watch for security notifications from services they use, change passwords if instructed to do so and be cautious of phishing messages exploiting publicity surrounding the incident.
news_share_descriptionsubscription_contact
contact_the_ombudsman
is_there_an_error_in_this_story
