On Wednesday, October 21, 2026, one of the most widely used pieces of web infrastructure became the subject of an unusually blunt warning from the world's security agencies. The US National Security Agency told every organisation running PHP to prepare for an emergency update and to take systems offline if they could not patch right away.
Within hours, government websites in several European countries were going dark, hosting companies were racing to roll out fixes, and security teams around the world were asking the same question: how bad is this, and are we already exposed?
This is the story of what happened, in order, and what it means for anyone who runs a website.
What is PHP, and why does this matter?
PHP is the server-side programming language that sits behind a huge share of the internet. It handles things like processing forms, managing logins, and pulling content from databases. According to Web Technology Tracker W3Techs, PHP powers roughly 70% of the websites whose server-side language can be identified, and it sits underneath platforms such as WordPress, Drupal and Joomla.
That reach is exactly why a serious flaw in PHP itself is a different kind of problem from a bug in one plugin or one app. The vulnerable code is in the interpreter that runs the site.
The two vulnerabilities
The PHP project disclosed two critical flaws, tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 on the CVSS v4.0 scale. CERT-EU, the cybersecurity service for EU institutions, said both can allow an attacker to run code remotely without logging in (PPC Land).
In plain terms, an attacker who can send a request to a vulnerable server may be able to take control of it. The agencies warned that this could mean stolen data, altered website content, or full control of the server.
The flaws involve memory-management failures inside PHP itself rather than mistakes in individual web applications. That means application-level defences alone cannot remove the risk. Every PHP installation that serves web requests is affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed (PHP.net).
How the flaws were found
The flaw was found because artificial intelligence played a central role. OpenAI said it led a coalition of researchers, security providers and others working on PHP vulnerabilities over the previous two months, and that AI agents helped uncover the flaws. PHP's maintainers led the fixes and the release, with partners such as Wiz and Cloudflare.
OpenAI framed the result as proof that its "Patch the Planet" security initiative can help defenders. The company said that, to its knowledge, frontier AI found this vulnerability before attackers did, buying defenders time to prepare (OpenAI).
The fix: what you need to do
- Update to a patched version. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- Check what your host is doing. WordPress's guidance notes that your web host may already be updating PHP and applying web application firewall rules, but you should still confirm and update if needed. Inside WordPress, you can see your PHP version under Tools > Site Health > Info > Server.
- Understand that WordPress itself needs no update. The flaws are not specific to WordPress and affect any server hosting a PHP application. No WordPress update is required or planned (WordPress News).
- If you can't patch yet, apply interim mitigations. The PHP team suggested setting session.upload_progress.enabled=0 (then restarting every worker), and on PHP 8.5 also setting fatal_error_backtraces=0 (PHP Archive).
The PHP team stresses that configuration changes reduce exposure to specific attack methods but cannot fully eliminate the vulnerabilities. - If you can't patch and can't mitigate, consider going offline. This was the advice from the NSA, FBI, CISA and others. Organisations that cannot remediate immediately should consider taking the system offline until it is fully mitigated.
What this tells us
Three lessons stand out.
Shared infrastructure concentrates risk: When one language runs most of the identifiable web, one flaw becomes a continent-wide event. Governments taking down their own sites as a precaution shows how seriously agencies weighed the downside of waiting.
AI is now part of the defender's toolkit: If the accounts are accurate, this was a case of AI-assisted research finding a critical flaw ahead of attackers, with a months-long coordinated effort across maintainers, researchers and security vendors. The harder question is the reverse one: the same capability is available to attackers.
Disclosure timing is fragile: The release was pulled forward by a day after the embargoed bugs were confirmed, leaving operators little time. Teams that already had a tested patching process fared best.