PHP Vulnerabilities Prompt Global Response as Websites Go Offline

A set of vulnerabilities in PHP, a widely used scripting language for web applications, raised alarms in the cybersecurity community on October 20, prompting a global effort to apply patches the following day.

The PHP maintainers issued an urgent notice regarding two critical bugs, identified as CVE-2026-109618 and CVE-2026-109619, which received severity scores of 9.2 out of 10. These vulnerabilities can enable remote code execution on unpatched websites, leading to significant security risks.

In response to the warnings, hundreds of websites experienced downtime as administrators worked to address the issues. PHP’s security team urged all users to prepare for upgrades, noting that PHP 8.1 and older versions no longer receive updates.

Fixes began rolling out after 10 a.m. Eastern U.S. time on October 21. Various government agencies, including those from the European Union, the U.S., Germany, Japan, Australia, the U.K., and the Netherlands, issued urgent alerts to website maintainers, advising them to patch their systems immediately.

Dane Knecht, CTO of Cloudflare, reported that the company had already observed attacks exploiting the vulnerabilities and implemented temporary mitigations for some customers. A video circulating on social media demonstrated the vulnerabilities being exploited.

Jake Knott, head of threat intelligence at watchTowr, noted that the cybersecurity firm is witnessing in-the-wild exploitation attempts using various proof-of-concept tools, some developed with AI assistance. He cautioned that while no successful attacks had been reported yet, it was only a matter of time.

Government and Corporate Responses

Numerous governments took proactive measures, with some even taking websites offline before the patches were released. Major companies, including Nintendo, also suspended services to address the vulnerabilities, which are being referred to as “PHP2Shell.”

Estimates suggest that over 70% of all websites on the internet utilize PHP. Experts from watchTowr highlighted that many enterprise networks run PHP-based content management systems and internal tools, making them susceptible to exploitation.

Don Smith from Sophos emphasized that the immediate challenge lies not only in installing patches but also in identifying and managing every instance of PHP in use. He noted that PHP’s widespread use means it can be embedded in various systems, often without the organization’s knowledge.

OpenAI’s Involvement

Following the release of the patches, OpenAI announced that researchers from a cybersecurity firm called Calif had discovered the PHP vulnerabilities two months prior through its “Patch the Planet” program. OpenAI collaborated with PHP and other companies to test the fixes and coordinate the response with infrastructure providers.

While OpenAI defended its role, stating that the vulnerabilities existed prior to their discovery, they acknowledged that AI could also facilitate exploitation by attackers. They stressed the importance of collaboration among organizations to implement effective protections.

Experts expressed concern that many PHP-backed websites continue to operate on outdated versions of the language that may not receive updates. Joviane Jardim, a senior security researcher at Detectify, warned that organizations often only discover forgotten PHP servers after an attacker exploits them.

Jardim noted that the public disclosure of these flaws before the release of fixes poses a significant risk. Attackers are likely compiling lists of vulnerable servers and will compare versions once patches are available. With AI, attackers can create working exploits rapidly, increasing the urgency for defenders to act.

He added that approximately half of all PHP websites run older versions that will not receive patches, highlighting a significant exposure risk. Jardim urged organizations to assess their PHP usage promptly, as speed in addressing these vulnerabilities is crucial.

Source: The Record