AI Uncovers Critical PHP Security Flaws, Putting Millions of Websites at Risk
Millions of websites around the world are facing an urgent security threat after researchers, assisted by artificial intelligence, uncovered two critical vulnerabilities in PHP, one of the internet’s most widely used programming languages.
The flaws could allow attackers to execute malicious code on vulnerable web servers without needing a username or password.
On October 21, 2026, the PHP development team released emergency security updates, urging website owners and hosting providers to update immediately.
The discovery has prompted emergency cybersecurity measures worldwide, with some government websites, banking services and other online platforms temporarily suspended while administrators apply fixes.
The vulnerabilities are particularly concerning because PHP powers major website platforms, including WordPress, Drupal and Joomla.
However, using PHP does not automatically mean a website has been hacked.
What Are the PHP Security Vulnerabilities?
The security alert concerns two vulnerabilities identified as:
- CVE-2026-109618: A memory-handling vulnerability that could allow attackers to exploit PHP when processing web requests.
- CVE-2026-109619: A vulnerability involving leftover internal program state that could potentially be exploited to execute malicious code.
Both flaws received a critical severity rating of 9.2 out of 10 under CVSS version 4.0, according to the PHP security team.
The vulnerabilities could enable remote code execution, an attack in which a criminal runs instructions on a server from another location.
Depending on the server’s configuration and permissions, a successful attack could expose sensitive information, compromise website files or allow further malicious activity.
The PHP developers warn that affected installations serving web requests require security updates.
Artificial Intelligence Helped Discover the Flaws
One of the most interesting aspects of this incident is the role artificial intelligence played in identifying the vulnerabilities.
According to OpenAI’s October 21 security announcement, a researcher known as Calif discovered a critical PHP flaw with assistance from GPT-5.6 Sol.
Cybersecurity company Wiz independently discovered and reported both vulnerabilities.
The organisations collaborated with PHP maintainers and infrastructure providers, including Cloudflare, to coordinate disclosure and develop protections.
However, the vulnerabilities themselves were not created by AI.
One of the underlying issues had reportedly been identified as early as 2024, but its security implications were not fully addressed at the time.
The PHP Foundation acknowledged shortcomings in how the earlier report was handled.
The incident demonstrates how AI can help security researchers identify weaknesses in existing software, including vulnerabilities that have remained unnoticed or unresolved for years.
Websites Worldwide Rush to Install Emergency Updates
The disclosure triggered widespread concern among governments, businesses and cybersecurity agencies.
Some government websites in Europe and Asia were temporarily taken offline while administrators implemented security measures.
Japanese financial institutions and government agencies also suspended selected online services as a precaution.
Meanwhile, Cloudflare CEO Matthew Prince reported a sharp increase in attempted exploitation following public disclosure.
Cloudflare observed thousands of suspected attempts before the announcement, followed by much higher volumes afterwards, reportedly reaching millions of requests.
These figures represent observed exploitation attempts, not millions of confirmed successful website breaches.
Which PHP Versions Are Affected?
The PHP development team released patched versions on October 21, 2026.
Website operators running affected installations should update to the appropriate fixed release or a newer supported security release.
| PHP branch | Minimum fixed version |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
The project also warned that PHP 8.2 will reach the end of security support on December 31, 2026.
Unsupported older versions should be migrated to maintained releases.
According to the official PHP security advisory, the vulnerabilities can affect different PHP web-serving configurations, including Apache, PHP-FPM, CGI, LiteSpeed and FrankenPHP.
The precise exposure depends on the software version and server configuration.
Are WordPress Websites at Risk?
WordPress uses PHP to generate web pages, process requests and run plugins and themes.
This means WordPress websites hosted on affected PHP installations may be exposed even when their WordPress software is otherwise up to date.
Updating WordPress plugins and themes remains important, but it is not a substitute for installing the PHP security patches.
Website owners should:
- Check their PHP version. In WordPress, navigate to Tools → Site Health → Info → Server, or inspect the version through the hosting control panel.
- Update PHP. Install the appropriate patched version through the hosting provider after checking application compatibility.
- Create a backup. Back up website files and databases before making changes.
- Review security logs. Investigate unusual server requests, unexpected file changes and suspicious administrative activity.
- Contact the hosting provider. If PHP updates are managed by the host, request confirmation that the relevant security fixes have been applied.
Operators unable to patch exposed servers immediately should follow official mitigation guidance and consider temporarily restricting access until the systems can be secured.
Frequently Asked Questions
What PHP vulnerabilities were discovered?
Researchers identified two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can potentially allow unauthenticated remote code execution.
Did artificial intelligence discover the vulnerabilities?
AI-assisted research contributed to the discovery. OpenAI reports that GPT-5.6 Sol helped identify one vulnerability, while Wiz independently identified and reported both flaws.
Is every WordPress website vulnerable?
Not necessarily. Exposure depends on the installed PHP version, server configuration and whether security patches have been applied.
Can updating WordPress fix the PHP vulnerabilities?
No. The affected PHP runtime must be patched. WordPress updates are important but do not replace PHP security releases.
Which PHP versions contain the fixes?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 contain the emergency fixes. Website operators should use those versions or newer supported patched releases.
How can I check my WordPress website’s PHP version?
In WordPress, open Tools → Site Health → Info → Server and locate the PHP version. You can also check through your hosting dashboard.
Have millions of websites already been hacked?
No such figure has been confirmed. Reports of millions of exploitation attempts do not mean millions of websites were successfully compromised.
