What happened?
On October 21, the team behind the PHP programming language said it had discovered two vulnerabilities. Both scored 9.2 out of 10 on the CVSS scale, a critical severity rating. The vulnerabilities allow attackers to run code remotely on a server without authentication. This could let them gain unauthorized access to files and databases, insert malicious code or alter a website’s content, redirect traffic to other sites, or use the server for DDoS attacks or spam campaigns.
The vulnerabilities have put almost 70% of all websites on the internet at risk of being hacked. That is the share of sites that use PHP, according to W3Techs estimates. The developers strongly recommend installing updates immediately. Updates are already available for PHP versions 8.2 and later.
What exactly is PHP?
PHP is an open-source scripting language created by Danish programmer Rasmus Lerdorf in 1995. It powers the server side of many websites and online services. Several groups now contribute to its development: the PHP Group, the official group of independent developers whose members include Lerdorf; the nonprofit PHP Foundation; and independent contributors.
PHP doesn’t have the best reputation among professional developers, though the reasons for that are rather odd. For example, it is easy for beginners to learn, which could be considered a good thing. But that also means a lot of bad code has been written in PHP. There is also a widespread view that it is unsuitable for complex systems, though that is not true. The language has long faced criticism for inconsistencies and illogical features resulting from its haphazard development.
Still, PHP remains more popular than its competitors. It was created specifically for web development, is simple to use, and has a huge ecosystem built around it. Many major websites, including Facebook, were originally built with PHP, and many continue to use it to avoid the enormous cost and effort of rewriting all their code.
So how do these vulnerabilities work?
Both vulnerabilities involve errors in how the server handles memory. Bugs in PHP’s code allow an attacker to trick the system into treating malicious data as safe.
- In the first case, the system processes a request incorrectly and crashes. When it tries to free that memory, a failure occurs that opens the server to remote control.
- In the second case, “leftover” data from a previous user is accidentally left behind in the server’s memory. This causes an error when a new request is processed, again allowing malicious programs to run.
How were the vulnerabilities discovered?
Researchers from two teams discovered the vulnerabilities independently. In August 2026, Calif researcher Ryan Austin found them using the GPT-5.6 Sol AI model. Separately, researchers at Wiz identified the same problems and reported them to PHP’s developers. They also used AI systems, including the Gemini 4 Argon and GPT-5.6 Sol models, as well as their own tool, Wiz Atlas.
OpenAI said in a statement that the PHP development team spent two months working with partners at Wiz, Cloudflare, and other companies to fix the vulnerabilities. Their goal was to release an update before the problem became widely known and attackers began exploiting it on a large scale.
However, the PHP Foundation wrote on its blog that an external security audit had detected signs of one of the vulnerabilities back in 2024. At the time, a theory emerged that attackers could exploit an out-of-memory error. But the developers found no specific way to use it in a cyberattack and turned their attention to more obvious threats. Thai Duong, the head of Calif, told The Wall Street Journal that the problem had been present in the code for decades.
Are they really that dangerous?
OpenAI says the vulnerabilities are among the most far-reaching cybersecurity threats in recent years. Volker Dusch, a security engineer who works on the PHP project, agrees. He says this is the most serious problem the programming language has faced in more than 10 years.
Dusch believes the situation is comparable to Heartbleed, a bug in the OpenSSL cryptographic library that allowed attackers to steal servers’ private keys. That problem became public in 2014, when about half a million websites were vulnerable to attack — roughly 17% of all secure web servers.
Who is at risk?
It might seem that PHP vulnerabilities are a problem only for system administrators, but that isn’t the case. Attackers can target a vulnerable website and steal users’ personal data. They can also alter its content. Someone visiting a familiar website could then fall victim to a phishing attack or end up with infected software on their device.
Finally, critical vulnerabilities like these can affect websites’ availability. In this case, for example, some government agencies in Belgium, the United Kingdom, Denmark, the Netherlands, Finland, and France had to take their public websites and services offline temporarily. Agencies in more than a dozen countries took similar measures. Several other countries only recommended taking sites and services offline.
In Russia, Reg.ru, one of the largest domain registrars and hosting providers, reported temporary restrictions on file uploads because of the PHP problems. The television channel TV Rain also temporarily took its website offline.
But if the vulnerability has been fixed, what is there to worry about?
Just because an update is available doesn’t mean system administrators at every company and organization will install it promptly. According to Netcraft, there were almost half a billion websites worldwide as of July 2026. But only 216 million were considered active, meaning they were still being maintained and regularly updated. There is a high risk that people will visit a forgotten website and fall victim to a cyberattack.
Many website-building platforms use PHP, which complicates the problem. The most popular, WordPress, accounts for more than 58% of the market. In Russia, the closest equivalent is 1C-Bitrix, though it was designed primarily for corporate clients. The risks for Russians are even higher, since more than 90% of websites on the Russian internet use PHP.
Many websites also use older versions of PHP, such as 8.1 and earlier. Official support for these versions has ended, and moving to newer ones often requires rewriting old code. Although the developers made an exception in this case and released patches for older versions, installing them on servers could be difficult and take considerable time.
At Meduza, we are committed to transparency about our use of artificial intelligence in the newsroom. The story you’re reading was written by one of our living, breathing journalists and translated from Russian using an AI model configured to follow our strict editorial standards. This translation process is the result of extensive testing and refinements to ensure our English-language coverage is timely and accurate. A Meduza editor reviews every draft before publication.
If you find any errors in this translation, please contact us at reports@meduza.io.
To read Meduza’s exclusive content in English, please subscribe to our newsletter.