Web administrators received an urgent alert from the US National Security Agency regarding two severe security flaws in PHP, which powers about 70% of all websites globally.
Bad actors could exploit these security gaps to seize remote control of web servers, view confidential data, and breach databases without any login details.
On Wednesday, October 21, the NSA stated that groups need to patch their PHP setups right away. The agency additionally suggested shutting down unprotected sites if fixes cannot be installed quickly.
Millions of Websites at Risk
Websites and online apps rely heavily on PHP, including well-known content management systems like WordPress, Drupal, and Joomla.
Two security weaknesses, designated as CVE-2026-109618 and CVE-2026-109619 and grouped under the name PHP2Shell, were found by security researchers.
The defects involve error handling and memory management in PHP. Attackers can leverage specific circumstances to execute harmful code on servers without needing authentication.
Security firm Wiz reported that these root problems have existed since PHP 5.4, which launched more than ten years ago.
Still, not every site running PHP faces danger, because risk levels rely on the active version and how the server is set up.
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or…
— NSA Cyber (@NSACyber) October 21, 2026
AI Helped Discover the Flaws
Artificial intelligence was key in spotting these security gaps.
Calif, a cybersecurity business, found one major flaw by using OpenAI's GPT-5.6 Sol model through the Patch the Planet program.
In a separate effort, the Google Wiz security division applied its Wiz Atlas AI agent, Gemini 4 Argon, and GPT-5.6 Sol to uncover several PHP vulnerabilities.
Both groups collaborated with PHP creators to examine the problems, build security fixes, and test the patches prior to releasing their discoveries to the public.
Additional tech firms such as Cloudflare, AWS, Akamai, Microsoft, Automattic, Fastly, and Vercel also helped prepare the security measures.
Security Patches Released
Security updates fixing both vulnerabilities came out from the PHP Foundation on October 21, 2026.
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 are among the updated versions.
Site administrators need to update to the newest secure version matching their supported PHP release. Older setups that lack support might demand a bigger upgrade.
The NSA also told entities to find at-risk systems, boost security checks, and temporarily shut down impacted services if fast patching is out of reach.
WordPress pointed out that the flaws do not target its system alone. To fix the root security issues, site owners must update PHP, frequently by working with their hosting providers.
AI Raises New Security Concerns
Researchers caught the vulnerabilities before any attackers were known to use them, according to OpenAI.
Nonetheless, security specialists cautioned that AI might also make it simpler for hackers to use these defects.
Wiz noted that artificial intelligence models assist attackers in modifying malicious code for various PHP versions, server setups, and memory layouts, which lowers the technical skill needed before.
Even though experts had not verified mass exploitation when the details came out, technical facts and early proof-of-concept attacks started spreading publicly.
Because of this, security authorities are telling web operators to apply existing patches right away to stop possible attacks.
