The team behind PHP released emergency security updates on Wednesday to fix two critical vulnerabilities, a day after details about the flaws leaked online.
The UK’s National Cyber Security Centre (NCSC) is urging organizations to install the fix immediately.
What is PHP?
PHP is a programming language that runs on web servers. When you load a webpage, PHP often runs behind the scenes, retrieving data from databases and building the page before it reaches your browser. BleepingComputer notes that it powers many websites, including content management systems, online stores, and custom web services. According to the NCSC, PHP is also built into a range of other products.
The NCSC says the two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, could allow an attacker to run their own commands on a PHP-based server without logging in. This is called remote code execution, and it’s one of the most serious kinds of security bugs.
According to the NCSC, an attacker could overload PHP’s memory to corrupt it, then, under certain conditions, use that corruption to take control of the server. One of the flaws involves how PHP processes form submissions and file uploads.
PHP rated each flaw 9.2 out of 10 on CVSS, the industry’s standard severity scale. Security firm watchTowr described them as a perfect 10, BleepingComputer reported, and so did an anonymous Hacker News post that has since been deleted. Researchers have started calling the bugs "PHP2SHELL."
The fixes were originally planned for a coordinated release later this week, so companies would have time to prepare. Then, information about the flaws leaked early. Speaking to BleepingComputer, watchTowr CEO Benjamin Harris said the vulnerabilities are "indeed real" and affect PHP versions 5 through 8. The firm said it had reproduced one of them.
PHP moved its release up to 10 a.m. ET Wednesday. As of Tuesday, watchTowr said it hadn’t seen anyone exploiting the flaws. By Wednesday, Cloudflare CTO Dane Knecht said on X that the company was seeing early attacks, according to BleepingComputer.
This Tweet is currently unavailable. It might be loading or has been removed.
The NCSC says organizations running PHP 5 or later are affected and should update to the latest fixed version. Anyone still using an older, unsupported version should move to a supported one.
Wikipedia impacted by PHP vulnerability
Wikipedia went down for a time on Wednesday, and the Wikimedia Foundation, the nonprofit that runs the site, confirmed to Mashable that the outage was tied to the PHP vulnerabilities.
In a statement to Mashable through email, the foundation said it is working to address the flaws in PHP, which it described as the programming language behind most wikis, including its own projects. "This issue affects all known versions of PHP, and is not specific to the Wikimedia Foundation," the statement said.
The foundation added that all of its PHP-based systems are affected, along with volunteer-run systems that use PHP. It has also taken several other systems offline as a precaution until they can be safely patched. Wikipedia was back up as of this writing.
Who else is affected, and what should you do?
If you only browse the web, there’s nothing for you to install. The fix is up to the people who run websites.
If you run a website, blog, or online store, check whether it uses PHP and make sure it’s up to date. If a hosting company manages your site, contact them to confirm they’ve applied the patch.
For organizations, the NCSC recommends:
Finding every system that runs PHP, starting with the ones reachable from the internet.
Watching for updates from vendors whose products include PHP.
Taking systems offline if they can’t be fixed quickly.
Checking any system that couldn’t be updated right away for signs of a break-in.
Cloudflare has added emergency firewall rules designed to block suspicious requests linked to the flaws. The rules are available to all its customers, including those on free plans.
Want to learn more about getting the best out of your tech? Sign up for Mashable's Top Stories and Deals newsletters or get Mashable push alerts today.