Web administration teams around the world are racing to head off a widespread disaster after a serious vulnerability was found in a programming language used to build much of the World Wide Web.
On Wednesday, the developers behind PHP, which is used by as many as 70 per cent of websites, released emergency security updates to fix critical flaws that attackers could exploit to gain remote control of certain systems.
As a precaution, many government, hospital and school websites in Europe went dark. The operator of the online encyclopaedia Wikipedia took a number of systems down until they had been safely patched, and the Internet Archive, the popular online library, was briefly taken offline to deal with the issue.
The US NSA Cybersecurity account on X recommended that organisations take their systems offline if “an immediate update is not feasible”, and the UK’s National Cyber Security Centre issued the same advice.
“...These vulnerabilities often provide a direct path to the server’s file system or database,” NSA Cybersecurity said.
CERT-In, the Indian Computer Emergency Response Team, has rated the severity as “critical”. In its impact assessment, it warned of “potential for remote code execution and compromise of the affected systems”, and it has advised users to install the latest security updates.
The PHP Foundation has published details of the two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. They affect “all PHP installations serving web requests” going back to PHP version 5.4.
The flaws have been present in PHP for over a decade. However, exploiting them “required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve”, according to the security firm Wiz. That changed with powerful AI models, which have made it far easier to turn complex bugs into working attacks.
The vulnerabilities, collectively called PHP2Shell, were found by teams at OpenAI, the Google-owned cybersecurity company Wiz and another cybersecurity company, Calif. PHP2Shell could allow attackers to execute code and read memory containing sensitive information such as passwords.
“With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work,” Wiz said. The bugs were discovered in August but were disclosed publicly only on Wednesday, once PHP had a fix ready.
In its advisory announcing the fixes, the team behind the open-source language said: “There are no complete mitigations, updating is the only safe choice.”
As a user, there is nothing much one can do as the vulnerability affects servers running PHP and doesn’t necessarily target users directly. But if someone has a blog or website, they should check the version of PHP the site uses, if any. For those using a service like Squarespace or Wix, there shouldn’t be any threat as those don’t support PHP.
Since its development in the 1990s, PHP has become an essential scripting language for web development. It powers WordPress, Joomla, Drupal and Wikipedia’s MediaWiki, among many others.
“...We consider this one of the most impactful security issues in recent memory. It highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits,” OpenAI said.
The vulnerabilities are being likened to Heartbleed, which in 2014 exposed the fragility of the shared infrastructure that secures the Internet and set off a global race to protect hundreds of thousands of servers.
“We believe PHP2Shell could mark a similar turning point for the AI era, illustrating how AI can change the practical exploitability of longstanding vulnerabilities. Building the exploit required chaining multiple flaws and adapting to each target’s
memory layout through repeated testing and debugging,” Wiz said.
The vulnerabilities are of the magnitude where an attacker could take full control of a server, which includes gaining access to passwords, API keys, cryptographic certificates, and databases of sensitive information.
“Across India, the government portals, college websites and small online stores run on PHP, often through WordPress, and many are looked after by a vendor who updates once a year. That is where the real exposure lies. Every organisation should move to the fixed versions today, restart PHP services and check the last 48 hours of logs for intrusion. Patching after a breach is not patching; it is clean-up,” 63SATS Cybertech joint managing director and joint CEO Srinivas L. told The Telegraph.