The FBI Cyber Division and global cybersecurity agencies issued urgent warnings after researchers found two severe security flaws in PHP, the server-side scripting language that powers roughly 70 percent of websites worldwide. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, carry a CVSS score of 9.2 and permit unauthenticated remote code execution in PHP core. The emergence of the PHP vulnerability led officials to urge system administrators to apply emergency patches immediately or sever internet connections before attackers exploit vulnerable networks [1].
Emergency Warnings from Global Agencies
Japanese Prime Minister Sanae Takaichi posted an urgent request on X that drew more than 23 million views within hours, asking organizations across Japan to check whether their public-facing websites run on PHP. She advised companies to apply the emergency security fixes as soon as they rolled out or temporarily suspend web services to cut risk. It was an unusually technical appeal from a sitting head of government, showing the gravity of the situation [7].
United States cyber agencies echoed that warning as reports of early scanning activity surfaced. The National Security Agency posted on X that the flaws provide a direct path to a server’s file system or database, advising organizations to take systems offline if they can’t patch quickly [5]. The FBI’s Cyber Division urged administrators to monitor server processes for unexpected command shells or unauthorized file downloads [1].
Government web portals in Europe went dark to shield internal networks. In Finland, authorities temporarily shut down public services, including portals operated by the National Land Survey [4]. Dutch authorities took down websites for the Tweede Kamer, the lower house of parliament, and the National Institute for Public Health and the Environment. The UK National Cyber Security Centre advised teams to sever internet connections until mitigations are complete [3].
Scope of the PHP Vulnerability
PHP powers vast swaths of the internet, running behind popular content management systems such as WordPress, Drupal, Joomla, and Adobe Magento [4]. Web tracker W3Techs estimates that the language powers roughly 70 percent of websites with known server-side programming languages. Palo Alto Networks’ Unit 42 reported identifying more than 22.6 million internet-exposed PHP instances that could face exploitation [5].
Exposure reached into public administration as well as private hosting environments. A Nextgov/FCW analysis using Shodan cataloged roughly 900 results linked to American federal, state, and local government websites running PHP [5]. Cybersecurity company Wordfence noted that updating WordPress core does not patch underlying PHP server packages, meaning administrators must upgrade the hosting environment to prevent risks like a critical WordPress flaw [2].
Disruptions quickly hit public portals and entertainment services worldwide. The Wikimedia Foundation temporarily disabled several backend systems supporting Wikipedia while teams applied security patches. Online portals for BBC programmes including Doctor Who and The Traitors became unreachable [3]. Japanese entertainment platforms and gaming services, including Bandai Namco, Uma Musume, and Kmanga, also scheduled emergency maintenance [6].
AI Discovery and the Leaked Disclosure
Researchers discovered the flaws by deploying artificial intelligence models against legacy code that had stood unchanged in PHP core for more than a decade [3]. Cybersecurity firms Calif and Wiz identified the vulnerabilities through OpenAI’s “Patch the Planet” initiative, utilizing the GPT-5.6 Sol model to analyze core source files that had escaped human review for fourteen years [5]. OpenAI President Greg Brockman stated that an early version of the bug was noticed in 2024 but dismissed before frontier AI models helped researchers build functional exploits across multiple web applications in hours [6]. Researchers at Wiz dubbed their demonstration php2shell, showing that an attacker can execute arbitrary commands on unpatched servers or read sensitive memory containing passwords, authentication tokens, and private API keys without valid login credentials [4].
The PHP Foundation planned to disclose the vulnerabilities in late October alongside finished software updates, but leaked screenshots altered that schedule. A post describing the flaw surfaced on the Hacker News forum on Tuesday morning and spread across social platforms before moderators removed it. The leak forced maintainers to rush out their alert and release fixes a day early, giving system administrators minimal time to plan their rollout [5].
Attack attempts followed the leak within hours. Cloudflare Chief Technology Officer Dane Knecht said the firm detected early attack traffic and deployed updated web application firewall rules to block new vectors. Security firm Patchstack also received reports of active exploitation from hosting partners [2]. Security consultant Davi Ottenheimer said attackers don’t need to know what software runs on a target server, because sending a single crafted upload can trigger the flaw [4].
Mitigating the PHP Vulnerability
The PHP Foundation released emergency updates for active branches, publishing versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on Wednesday [7]. Maintainers warned that the vulnerabilities affect every version dating back to PHP 5, which originally launched in July 2004. However, only PHP 8.2 and newer branches receive official updates, leaving older versions dependent on third-party vendor backports [4].
Security consultant Lukasz Olejnik of King’s College London warned that unpatched legacy installations pose severe risks because worms could spread across vulnerable hosting environments [4]. System administrators running Linux distributions must check whether their operating system vendors provide backported fixes for older releases. Trey Darley, founder of cybersecurity consultancy Proper Tools, said defenders face an uphill battle because they can’t easily catalog every asset that runs PHP [5].
Authorities advised teams to take strict recovery steps if they detect signs of intrusion. The FBI recommended isolating compromised machines, preserving web server and PHP logs, and reporting incidents to local field offices or ic3.gov [1]. Don Smith from the Sophos Counter Threat Unit said defenders must verify whether attackers gained a foothold on the server before the update was applied [3].
Maintenance Pressures on Core Infrastructure
The global disruption exposed the fragile maintenance model supporting foundational web technologies. The PHP Foundation acknowledged that its security work relies on a small group of core developers and volunteers who must manage complex codebases that power millions of businesses. While automated AI tools now discover bugs faster than ever, the foundation stated that software can’t replace experienced engineers who evaluate compatibility trade-offs and review patches [6].
Governments stepped in to coordinate incident response with private technology firms. The White House engaged its Super Intelligence Force, the Office of the National Cyber Director, and CISA to help critical infrastructure operators deploy protective guidance [5]. In Japan, Takayuki Sugiura of the Japan Hacker Association warned that successful exploits give attackers total control over vulnerable machines, allowing them to steal, encrypt, or delete records [7].
With automated exploitation tools multiplying, administrators can’t treat security as a one-time chore. Organizations must inventory every server and third-party software package that bundles PHP, ensuring that monitoring tools catch unexpected shell processes [1]. Keeping systems updated remains the only reliable defense against emerging threats on modern networks [4].
- WEBSITE FBI Cyber Division. (2026, October 21). Security advisory on PHP core vulnerabilities. [Article Link]
- ONLINE NEWS Castellanos, S. (2026, October 21). Two critical PHP vulnerabilities threaten millions of websites worldwide, EU warns of potential shutdowns as cyberattacks begin. Wccftech. [Article Link]
- ONLINE NEWS Gerken, T., & Cress, L. (2026, October 21). Websites taken down worldwide as critical PHP cyber-security update issued. BBC News. [Article Link]
- ONLINE NEWS Burgess, M., & Newman, L. H. (2026, October 21). ‘This is not a drill’: Critical PHP vulnerabilities are setting the internet on fire. WIRED. [Article Link]
- ONLINE NEWS DiMolfetta, D. (2026, October 21). Critical flaws in ubiquitous website software draw urgent warning from NSA, FBI. Defense One. [Article Link]
- ONLINE NEWS The Economic Times. (2026, October 21). Multiple websites go offline after critical PHP security flaw; FBI urges immediate updates. [Article Link]
- ONLINE NEWS OfficeChai Team. (2026, October 21). Japan’s Prime Minister, USA’s FBI take to X warning people over the PHP vulnerability. OfficeChai. [Article Link]
