Two critical vulnerabilities in PHP, the server-side language behind most websites, have been discovered, allowing unauthenticated remote code execution (RCE) on affected servers. The flaws, identified as CVE-2026-109618 and CVE-2026-109619, each carry a severity rating of 9.2 out of 10 and affect every release dating back to PHP 5 in 2004.
PHP powers roughly 24 million websites, according to BuiltWith, and about three-quarters of all sites whose language can be identified, according to W3Techs. The vulnerabilities went undetected for more than a decade and were found using artificial intelligence (AI) by security firms Wiz and Calif.
The UK's National Cyber Security Centre (NCSC) described a vulnerability that would allow an attacker to trigger an out-of-memory condition that corrupts memory and, under certain conditions, achieve unauthenticated remote code execution. In other words, the attacker gets a shell on the server and a direct path to the file system and the database.
Official bodies around the world, including the US National Security Agency (NSA) and the EU's CERT-EU, have told organisations to act immediately. 'Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated,' the UK's NCSC said.
What to do now
Organisations are advised to identify every system running PHP, prioritising internet-facing systems, and update to the latest fixed version of PHP (8.2.35, 8.3.36, 8.4.27 or 8.5.12). For PHP 8.1 or older, users should contact their distribution or long-term support vendor for a backported fix, or upgrade to a supported version.
If patching is not possible, users can apply the PHP Team's temporary mitigations or take the system offline until it can be fully mitigated. Before upgrading an unpatched system, users should check for evidence of compromise and backdoors.
Affected companies and organisations
Several high-profile companies and organisations have been affected, including Wikipedia (Wikimedia Foundation) and the WordPress, Drupal, Joomla, Magento, phpBB, MediaWiki, Laravel, Symfony and WHMCS ecosystems. In the UK, Edinburgh Council and several BBC programme pages, including Doctor Who and The Traitors, have been taken offline.
In Finland, the state IT provider Valtori took government public services offline 'as a precautionary measure'. In the Netherlands, the National Cyber Security Centre pulled its own site, alongside the Port of Rotterdam, the Overheid.nl portal, the KNVB football association and several hospitals. France's Interior Ministry placed all its sites into preventive maintenance, and Denmark's Kombit shut down several services.
The impact was immediate and global, with many websites and services taken offline to prevent exploitation of the vulnerabilities. DeviantArt and other consumer sites reported downtime, and Sakura Internet suspended a database appliance function in Japan.
Timeline of events
- Early August 2026: A security researcher first flags the issue
- Friday 16 October: The White House says it was first made aware of the flaw
- 20 October: PHP maintainers publish an advisory for two 9.2-severity vulnerabilities, with patches scheduled about 12 hours later
- 20-21 October: Purported exploit details and a 'PHP2Shell' video leak, showing remote code execution on WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symfony, Drupal and WHMCS
- Wednesday 21 October, 13:34 UTC: Source fixes land in the php-src GitHub repository and patches begin rolling out
- Wednesday 21 October: NCSC, NSA, CERT-EU and agencies in Australia and Japan urge patching or takedowns; Finland, the Netherlands, France and Denmark take sites offline
The discovery of these critical vulnerabilities highlights the importance of keeping software up to date and the need for organisations to have a robust patch management process in place. With the potential for widespread exploitation, it is essential that organisations take immediate action to protect their systems and data.
