TWO major flaws have emerged in PHP, the scripting language behind much of the web.
Upon its discovery – by AI, no less – the incident forced hundreds of sites offline this week.
Dubbed PHP2Shell, both are rated 9.2 out of 10 for severity. It's serious enough that both the FBI and the US National Security Agency issued emergency warnings.
Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially… pic.twitter.com/tnwiQv5v0F
— FBI Cyber Division (@FBICyberDiv) October 21, 2026
Tech media pointed to "serious vulnerabilities", though emergency patches are now on the way, as per Techzine Global.
Wired explained that the pair of critical, remote-code execution vulnerabilities in PHP — collectively dubbed by security researchers (including Google-owned Wiz) as PHP2Shell — sit in “core memory management” and “error-handling” parts of PHP.
Nearly every web request touches PHP2Shell.
Why it’s a serious flaw
If left unpatched, they open doors for hackers and cyber-thieves, Wired warns.
For one, they allow unauthenticated attackers to execute arbitrary code.
Worse, the gap would allow them to read sensitive server memory (such as passwords, API keys, and auth tokens) – and even gain a direct path to the file system or database.
The PHP Foundation has revealed two serious vulnerabilities that could impact millions of websites. Security experts warn that failure to quickly patch the flaws could have dire consequences. https://t.co/IWYU6vBjBc
— WIRED (@WIRED) October 21, 2026
This has set the tech world bonkers, sparking a global emergency and mass scrambling to patch or take down millions of websites.
Key details:
Date discovered: PHP announced the security release on October 20 and shipped fixes on October 21, after details leaked early.
Severity & Score: Both flaws were rated a critical 9.2 out of 10 on the Common Vulnerability Scoring System (CVSS).
Discovery via AI: The flaws were uncovered using artificial intelligence tools—specifically Wiz Atlas alongside models like Google Gemini and OpenAI's GPT—marking one of the first times AI-uncovered software flaws caused a massive, worldwide infrastructure scramble. (Source: Wired)
Why did sites go offline? Details leaked before the planned fix, so administrators shut sites down as a precaution until they could update. (Source: Huntress)
What now? PHP released patched versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Site owners must install them. Users can’t fix it, but should watch for breach notices and use strong, unique passwords. (Source: Qualys)
Here are the 5 reasons ordinary internet users are affected:
#1. Why a PHP security problem matters to you
PHP is a programming language that quietly runs a huge share of the websites you visit. Some reports estimate it powers around 70% of the internet. It works behind the scenes, so most people never see it. But it’s there when you shop online, post in a forum, or log into a government portal.
Popular website-building tools like WordPress, Drupal, Magento, Joomla and Laravel are all built on PHP. Think of PHP as the engine and these tools as the cars built around it. If the engine has a known defect, every car using that version is at risk.
That’s the concern here: a website running an outdated or flawed version of PHP could be vulnerable to attackers, even if its owner did everything else right.
You can’t fix this yourself, but you can use unique passwords, turn on two-factor authentication, and be cautious about sharing sensitive details with sites that seem neglected.
What PHP means: The acronym PHP currently stands for PHP: Hypertext Preprocessor. It is a popular, open-source, server-side scripting language used primarily for building dynamic websites and web applications. However, the name has a double meaning because it is a recursive backronym — meaning the acronym itself refers back to its own name
#2. What “no password needed” really means
Normally, to break into a website’s server, an attacker would need a login. These PHP bugs skip that step. Anyone on the internet could, in theory, send the server a specially-crafted request and trick it into running the attacker’s own commands, without ever signing in. This is called “remote code execution,” and it’s one of the most serious kinds of security flaws.
The second risk is a data leak. A server keeps information it’s currently working with, such as passwords, in its temporary memory. One of these bugs could let attackers peek at that memory.
Both problems come from sloppy housekeeping inside PHP. One involves how it reacts when a server runs low on memory. The other involves how it handles leftover data from earlier requests, like a waiter forgetting to clear the previous customer’s order from the table.
For everyday users, the fix lies with website owners, who need to update PHP promptly.
#3. Why websites are going offline
When a serious security hole is found in software that much of the internet depends on, a patch isn’t always ready right away. Until it is, the safest short-term move for some organisations is to switch their services off.
That’s what happened here. In the Netherlands, DigiD (the national login system for government services) and MijnOverheid (a portal for personal government records) went offline. Nintendo and other companies pulled services too. Sites in France, Germany, Belgium, Finland and the Czech Republic were also taken down, many only as a precaution before a fix was available.
Even the NSA, the US signals intelligence agency, told organisations to update or disconnect. Think of it like a manufacturer recalling a car over a brake fault. Owners park the car until the repair is ready, because driving it is riskier than being inconvenienced.
For you, outages are annoying but a good sign: it means someone is protecting your data.
#4. 'Patching' will be uneven
PHP shipped fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, yet experts fear millions of sites run ancient versions that likely cannot be updated. Support for PHP 8.1 and earlier has ended, though emergency backports exist for 7.4, 8.0 and 8.1.
One estimate counts more than 22 million exposed servers.
#5. Why this is a race against time
Normally, when researchers find a serious software flaw, they tell the maker privately. The maker builds a fix, and details are published only once the fix is ready. That gives defenders a head start.
Here, that plan broke down. Details leaked before the planned announcement, and “proof-of-concept exploits” (working demonstration code showing how to abuse the flaw) are now circulating. Anyone with bad intentions can copy and adapt them.
Reports about actual attacks currently disagree.
Security firm watchTowr says attacks are already happening “in the wild,” meaning against real websites. CISA, the US cybersecurity agency, said it hadn’t seen any when it issued its alert.
Both can be true: the situation moves quickly, and different groups see different things.
Think of it like a burglar’s lockpicking guide being posted online before the lock company has shipped a replacement. Until it’s clear nobody is using it, the sensible assumption is that someone is.
For website owners, that means updating PHP immediately. And Until that is settled, treat the risk as “live”.
AI twist: Teams at OpenAI, Wiz and Calif found the flaws with AI help, and Wiz compares the episode to 2014’s Heartbleed bug. Hosting providers moved quickly: SiteGround said its customers were protected at the server level, and Google Cloud published protections for its own customers.
Why it matters
PHP sits beneath a huge share of websites, so one flaw touches banks, shops, schools and government portals alike. Unauthenticated code execution can mean stolen credentials, defaced pages or ransomware, while precautionary shutdowns show how a single bug can interrupt public services.
It also shows AI speeding up both bug discovery and attack timelines. Because many operators patch slowly, exposure can outlast the headlines and leave users vulnerable far longer.
What’s next
Expect continued patching and scanning as attackers probe unpatched servers. Operators should update to the fixed versions, apply temporary mitigations if they can’t, and retire unsupported PHP.
Watch for advisories, confirmation of active exploitation, breach disclosures from affected sites, and debate over coordinated disclosure after the leak. Hosts and security vendors roll out server-level protections for customers unable to patch.
What it means for you
You can’t patch PHP yourself, so focus on what you control.
Expect some sites to be briefly unavailable, and be wary of phishing that exploits the news.
Change passwords on important accounts, especially if a site you use announces a breach.
Enable two-factor authentication, and check statements for odd activity.
A password manager also helps. Site owners should use the fixed versions 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or ask their host about protections, and not rely on configuration changes alone, according to Wired.