A critical PHP security flaw has triggered urgent updates across the world. Governments, technology companies and website operators are working to protect vulnerable systems.
PHP powers many of the world’s websites. Security researchers warn that hackers could exploit the newly discovered weaknesses.
Researchers identified two vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Together, they are known as php2shell.
According to the BBC, the flaws affect PHP versions released over the past decade. Researchers gave the vulnerabilities a severity score of 9.2 out of 10.
NBC News reported that no successful attacks had been publicly confirmed as of Friday. However, authorities across the United States, Europe, Asia and Australia urged organisations to install patches immediately.
Some organisations also temporarily took vulnerable systems offline. Others suspended websites and public services while applying security updates.
Cybersecurity risks
PHP, which stands for Hypertext Preprocessor, is an open-source server-side programming language that has powered dynamic websites and web applications since the 1990s.
Despite its age, it remains one of the internet’s most widely-used technologies.
It powers platforms ranging from WordPress, online stores, to Wikipedia, while frameworks such as Laravel, Symfony and Drupal also rely on the language to build and manage web applications, according to BBC’s report.
Researchers from cyber-security firms Wiz and Calif said the newly-disclosed vulnerabilities exist within PHP itself rather than individual websites, meaning that any services built and running on PHP could be exposed if left unpatched.
Under certain conditions, attackers could exploit the flaws to gain control of web servers and access sensitive information stored on them.
Serious vulnerability
Calif researcher Ryan Austin told BBC that it was “the most serious vulnerability I’ve ever found.”
Security experts also warned that organisations with older or poorly maintained systems could face greater risks.
He added that it “started with a hunch that I would not have been able to scratch without AI.”
AI’s role in detecting flaws
The vulnerabilities were uncovered independently by researchers at Wiz and Calif using advanced artificial intelligence (AI) tools developed by OpenAI.
A security researcher from Wiz, Sagi Tzadik, initially thought the AI agent had made a mistake when it unexpectedly identified the PHP flaw while testing whether a separate security weakness found in WordPress could also affect Drupal, according to a report by TIME.
“Models tend to hallucinate,” he told the magazine.
Yet, the exploit worked perfectly, even though the vulnerability had gone undetected for over a decade.
Researchers from both organisations then worked together alongside the PHP Foundation to prepare fixes before the issues became public.
However, information about the flaws leaked two days before the patch was set to launch.
Public announcement
Because of this, hackers have begun to try to exploit it, forcing developers to rush the security announcement, according to The Probe.
Cloudflare also said it detected thousands of attempts to exploit the vulnerabilities before the public announcement.
They said that the attempts climbed to tens of thousands within 45 minutes, hundreds of thousands within two hours and eventually millions as the details spread.
On Wednesday, the PHP Foundation finally released the patches to address the vulnerabilities.
It urged PHP users to install the patches immediately, according to the BBC.
