PHP security vulnerabilities: Why is the internet panicked and what govt, and big tech companies like Google, OpenAI and others said

Home » News » General » PHP security vulnerabilities: Why is the internet panicked and what govt, and big tech companies like Google, OpenAI and others said

Multiple vulnerabilities in the open-source scripting language PHP (Hypertext Preprocessor) has taken the internet by storm and sent ripple effects across the globe, issuing responses from big tech companies and governments worldwide, with the notable ones with India’s CERT-In, Unites States’ Federal Bureau of Investigation, OpenAI, Google and more. The extent of the flaws can be assessed from the fact that all individuals and organisations using PHP-led websites are affected.

✅ Thank you for completing the survey!

The Indian Computer Emergency Response Team has said the security issues could allow remote attackers to execute arbitrary code on a targeted system. In a security advisory, PHP said “PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35” fixes two “critical vulnerabilities” that may allow unauthenticated code execution remotely, which implies hackers can target websites to launch unwanted behaviour for personal gain.

Also Read: PHP security flaws explained: Affected versions, how to fix and more details

PHP users are advised to update immediately. As per the company, the risk is highest for mod_php, where an “unauthenticated request” may trigger attacks before any application code runs. For the unaware, PHP is built for server-side web development of dynamic web pages.

PHP vulnerabilities: What Indian government said?

CERT-In (Indian Computer Emergency Response Team) raised a “critical” security alert flagging critical remote code execution vulnerabilities in PHP. “Multiple vulnerabilities have been reported in PHP which could allow a remote attacker to execute arbitrary code on the targeted system,” CERT-In said in its vulnerability note. This could “compromise” the system completely. “These vulnerabilities exist in PHP due to memory corruption and improper resource control.”

CERT-In has published Vulnerability note on its website. Critical remote code execution vulnerabilities in PHP https://t.co/DBHzWvOM5t

— CERT-In (@IndianCERT) October 21, 2026

Responses from ChatGPT:

ChatGPT notes that the programming language is used to run around 70 per cent of websites. OpenAI was among the team of researchers and companies preparing the fix in the PHP engine over the last two months. “Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors,” @OpenAI said in an X post.

“Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory,” the ChatGPT maker noted.

Response from FBI:

Noting these critical vulnerabilities, the Cyber Division of the FBI said: “It is recommended that organisations take the system offline until it can be fully mitigated.” While urging users to immediately update the affected PHP installations, it requested users to monitor web servers for suspicious activity.

Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks. The FBI urges organizations to take the following steps now: ➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated. ➡️ Immediately update affected PHP installations following the guidance on https://t.co/rDrPSxB3zX. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP. ➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation. ➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or https://t.co/iqgVZIbCru. Those reports help us identify the actors involved and warn other organizations before they become victims. For the latest information, follow PHP’s announcement on https://t.co/rDrPSxB3zX, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.

— FBI Cyber Division (@FBICyberDiv) October 21, 2026

The activity includes “PHP processes unexpectedly launching command shells or downloading files.” Users were advised to isolate an affected system and preserve the web server and PHP logs.

Response from Google:

Google said Gemini 4 Argon and Wiz Research contributed to discovering this flaw. “Users of PHP running on Google Cloud may be vulnerable,” Google said. “We urge all customers running PHP applications on Google Cloud to immediately update to PHP 8.2 or newer, and redeploy their services using a patched version.”

Also Read: Millions of websites at risk? OpenAI’s GPT 5.6 Sol finds critical security flaws in PHP, here is all you need to know

Response from WordPress:

WordPress noted the issues are not specific to it. The platform said an update is not required for WordPress. However, it added that site owners were advised to check with hosting providers and add firewall guardrails.