A bug that allows hackers to remotely execute code has been discovered in PHP, the language that powers 70% of the world’s websites.
PHP shipped emergency fixes today for two of the most critical flaws, but over one-third of the web remains unpatched as of publication time.
The language, used to program website backends, runs on servers, not in the browser, and sends its resulting HTML or other dynamic data to the browser.
Official fixed releases only cover PHP 8.2 and newer, leaving over one-third of PHP websites without a patch.
Mid-day, backports were starting to roll out across older versions 7.4-8.1. Unfortunately, according to one estimate, more than 800,000 internet hosts serving content to millions of websites run a branch of PHP so old “that will get no fix” at all.
The two flaws, CVE-2026-109618 and CVE-2026-109619, are collectively PHP2Shell.
PHP2Shell lets an unauthenticated attacker run code on a web server and serve buggy outputs to a user’s browser.
Hackers’ exploits can occur even before a website’s own code executes.
Read more: Whitehat hacker accuses Injective of ghosting after $500M bug disclosure
AI hacked PHP, found a bug affecting most websites
A security researcher using OpenAI’s GPT-5.6 Sol model discovered the bug during an August audit funded by OpenAI.
That researcher was part of Calif, a partner in OpenAI’s Patch the Planet program, which pairs frontier models with expert human cybersecurity review.
The bug class had been flagged decades earlier yet dismissed as too hard to exploit, Calif’s CEO Thai Duong told the Wall Street Journal.
However, AI hackers have now figured out how to seize control of a server’s memory within a few dozen requests.
Wiz, a division of Google Cloud, confirmed the flaws independently. Wiz’s co-founder called PHP2Shell “the most severe AI vulnerability that was ever found,” and one humans would probably never have found.
Cloudflare reacts as PHP alarms ring around the world
Cloudflare’s CTO Dane Knecht reported live exploit vectors for every customer, including free plans.
The website cacheing giant implemented a stopgap emergency measure overnight before announcing more patches a few hours later.
*FINLAND SHUTS STATE INTERNET SERVICES OVER PHP FLAWS
— *Walter Bloomberg (@DeItaone) October 21, 2026
*NETHERLANDS CYBERSECURITY AGENCY TAKES WEBSITE OFFLINE OVER PHP FLAWS
*FRANCE TEMPORARILY TAKES PREFECTURE WEBSITES OFFLINE PENDING PHP FIX: MINISTRY https://t.co/mi9GbPXmOK
The PHP bug had worldwide impact. Finland’s state IT center shut several government web services as a precaution.
Meanwhile, in the Netherlands, NotuBiz’s council information sites for local governments went offline, with MijnOverheid and the Dutch parliament’s site following.
Patched versions of PHP include 8.5.12, 8.4.27, 8.3.36, and 8.2.35. However, 27% of PHP sites still run PHP 7, and 7.7% run PHP 5, which remain unpatched.
GoDaddy urged customers to upgrade.
Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTubechannel.
The post Remotely exploitable PHP bug found on 70% of world’s websites appeared first on Protos.