Developers of PHP, a backbone language for the internet, have warned that a security update might take millions of websites offline temporarily, sparking panic in the tech world.
The PHP Foundation, which describes itself as a "structured governance model designed to ensure transparency, accountability, and effective stewardship" of the language, announced a security update in a social media post to address "two critical vulnerabilities" that could be exploited by hackers. "PHP users are encouraged to prepare to update," the post said.
According to the PHP Foundation, "PHP stands for PHP: Hypertext Preprocessor, which confuses many people because the first word of the acronym is the acronym". PHP is an HTML-embedded scripting language designed during the earliest days of the internet that sought to simplify how web developers write and maintain websites quickly.
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.
— The PHP Foundation (@ThePHPF) October 20, 2026
PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
Government websites around the world have gone dark to prepare for the PHP patch and to lessen the likelihood that the vulnerabilities are exploited. Japan's Prime Minister Sanae Takaichi was one of several world leaders to address the issue.
"We have an urgent request for everyone to take action tonight," she posted on X. "Regarding PHP, which is used on many websites, the PHP security team has issued a warning about two critical vulnerabilities. Please check if your publicly available websites use PHP, and prepare to apply the fix."
The Netherlands, Finland, France and Australia have taken several government services offline temporarily to implement the patch and prevent any problems.
In the US, the National Security Agency's cybersecurity division also composed a strongly worded warning.
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or…
— NSA Cyber (@NSACyber) October 21, 2026
"Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update," the NSA's post on X read.
"If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance."
According to technology giant OpenAI, one of the company's models found the PHP vulnerability.
"Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory," a statement from the maker of ChatGPT read.
"It also marks a new phase, where AI can find security bugs with internet-scale impact."
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
— OpenAI (@OpenAI) October 21, 2026
Over the past two months, we led a coalition of maintainers, researchers,…
OpenAI said that the discovery of the vulnerability is proof of concept that its Patch the Planet security initiative is creating a safer web infrastructure.
"To our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare," the company said.
Moshe Siman Tov Bustan, a lead researcher for Ox Security, a New York-based network security firm said that the PHP vulnerability is not just fear without substance.
"If you have a publicly accessible PHP instance and haven't patched it, start from the assumption that you're exposed," he said. adding that if evidence of exploitation is found, people should also assume compromise and not just exposure.
"This is about as broad as a critical vulnerability gets,” he added.