Two critical security vulnerabilities in PHP, the programming language behind around 70% of the internet, were disclosed publicly on October 21, 2026, along with fixed patches. The flaws, which the Cybersecurity researcher, Ryan Austin at Calif, the US-based cybersecurity, has named “php2shell”, could let an attacker run their own code on a web server, according to a research paper published by the firm. Access the full paper here.
All the PHP versions from PHP 5.4 through 8.5.11 are still vulnerable and various technologists and countries officials’ have asked the websites to keep them updated to avoid the exploitations by cyber attackers and hackers.
Cert-In response: According to the risk assessment by the Indian official cybersecurity agency, the vulnerability is categorized as the high risk and is capable of “remote code execution and complete system compromise.”
Read Cert-In’s full vulnerability notes here. Similarly, CERT-EU and US CISA also issued advisories.
How severe is the attack? To illustrate the seriousness of this vulnerability, Matthew Prince, the Co-founder & CEO of Cloudflare. shared some stats on how the attackers grew as the news about the vulnerability got public. He wrote on X:
“[After the vulnerability was discovered,] we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.”
Reuters reported that the PHP vulnerability resulted in the shutting down of a few European government websites.
US National Security Agency asked the companies to shutdown websites if they can’t fix or update: “Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server’s file system or database. If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.” the Agency’s cybersecurity division wrote on X.
Open Broadcaster Software Project that develops OBS Studio, a free and open-source software application used for video recording and live streaming, said that their “website will be unavailable while we await disclosure of a PHP vulnerability.” However, it clarified that the streaming services are not interrupted. However, at the time of writing this report, the website remained accessible.
Kenya’s Ministry of Information, Communications and the Digital Economy issued an advisory asking the officials of Information and Communication Technology Authority (ICT) to
“prioritise remediation according to exposure an service criticality, maintain records of actions taken, and escalate unresolved high-risk exposures through the established Government ICT and cybersecurity coordination mechanisms.”
The New York Times reported that the Trump administration and some governments in Europe and Asia have told organisations to install the latest update and Wall Street Journal reported that some government and commercial websites tookdown their sites offline as a precautionary measure against possible attacks.
Cloudflare, which is also part of the research that helped in the discovery of the vulnerability and helped deploy protections ahead of the disclosure, says the two flaws are tracked through these :
- CVE-2026-109618: “PHP runs out of memory and interrupts its work before some internal data has been properly initialized. During cleanup of that request, PHP may use this unfinished data as though it were valid.”
- CVE-2026-109619: “A fatal error interrupts a request, leaving PHP holding references to memory that is released when the request ends. When the same PHP process handles a later request, it may follow those outdated references and access memory that is no longer valid and expose sensitive data.”
“Cybersecurity is entering a period of absolute chaos. And this might be the new normal for a while before things stabilise.” — Harshil Mathur, RazorPay CEO
Meanwhile, Bruce Dang, a Calif researcher, told the Times that the impact “will be felt for a while”.
Some background on how the vulnerabilities were discovered: PHP is open-source software that runs on a web server and builds the pages users see. Popular platforms such as WordPress, Drupal and Magento are written in it.
Calif researcher Ryan Austin led the work. Calif’s post says he started from a hunch about older flaws in PHP’s code and used an AI model as a helper. Calif says the initial discovery did not need a special testing setup or access to models that were not generally available.
The report also highlighted that AI did not do the job on its own, indicating that knowing the historical context of the software mattered, in its words, as much as ever. The same thought was echoed by the PHP Foundation too.
The New York Times reported that Calif said it found the bugs in a matter of days. According to the New York Times and Wall Street Journal , the researchers used OpenAI’s GPT-5.6 Sol for the initial findings and an unreleased OpenAI model to build the exploits.
A brief timeline of events, according to the Calif report:
- August 1: Calif finds multiple routes to remote code execution.
- August 11: Calif reports the first bug to PHP and begins coordinated disclosure, where the maker is told privately and given time to fix before details go public.
- August 14-15: Calif shares a working exploit with PHP, which confirms it works.
- August 21: Calif reports a second bug.
- October 21: Patched versions are released.
To check the status of a website, OpenAI has released a PHP version checker on GitHub. It reads the PHP version a site shows in its response headers, or from a local PHP install, and compares it against a list of fixed versions. OpenAI notes that the checker returns “unknown” if the version is hidden, that this does not mean the site is safe, and that some Linux distributions fix flaws without changing the version number.
Why this mattes: Several recent vulnerability discoveries can’t be shrugged off as AI hype or the hype or “fear monering” created by the media.
Jjust in the past 24 hours, these are the reported vulnerabuitlies that were either discovered, disclosed or either exploited and AI could have possibly been used in one way or another in each instance.
- eMudhra,
- WordPress,
- Microsoft,
- GitLab,
- Railway,
- Node.js
- LLMLite
- TiDB
- State Bank of India data breach
Listen to what PHP Foundation is saying after fixing the discovered patch:
“Tools now find bugs faster than ever, for defenders and attackers alike, and the number of reports will keep growing. What tools cannot do is decide on the right fix for a long-standing design decision in the engine, weigh the compatibility trade-offs, and review the patch. Making those decisions takes experienced engineers who know the entire PHP codebase, and today there are too few of them.”
Moreover, earlier the intent of the capable criminals or the attackers would’ve been the primary concern, but with the advancements in the tech, and AI specifically, the capabilities of the tech, or broadly “tools” as PHP Foundation has referred, has also become a primary concern too.
For instance, after the PHP incident was publicly disclosed, Dan Lorenc, the founder and CEO of US-based software supply chain security firm Chainguard, said that he and his team could find the vulnerabilities in PHP though just this prompt:
“find bad vulnerabilities in PHP”.
He said that they have used a “frontier model” and their own harness.
While the AI tech is giving unprecedented capabilities to humans and as the AI agents are going rogue as seen in the OpenAI and Hugging Face incident, the tech industry, the businesses and the regular users ought to be more careful than ever. As said by California-based global cybersecurity company, Palo Alto Networks’s CEO, Nikesh Arora:
“I am more concerned about what comes next. This is just one. There is more to come. The problem is when you start seeing big things like this happen, you start finding people who are trophy hunters. They’re going to say, ‘Where can I find the next PHP and prove to the world that I’m as smart as the last guy’.”
Also Read:
- Ten things wrong with India’s cybersecurity system: what the experts say
- ‘There are no principles set in place for AI agents’: a panel at Youth IGF
The post Explained: What are the two PHP vulnerabilities behind a global rush to update and why it matters appeared first on MEDIANAMA.