Key takeaways:
- Update PHP immediately: Website owners should install security fixes and confirm that their hosting providers have updated vulnerable systems.
- AI is changing cybersecurity: AI can help researchers find flaws faster, but it can also make it easier for attackers to develop exploits.
- Check outdated systems: Organisations should replace unsupported PHP versions, monitor suspicious activity, and strengthen their security measures.
Section 1: Critical PHP vulnerabilities trigger global cybersecurity alert
Two critical PHP security vulnerabilities, affecting a programming language used by approximately 70% of websites worldwide, have triggered urgent cybersecurity warnings from India and other countries. Known collectively as PHP2Shell, the flaws could allow attackers to execute malicious commands remotely without authentication and potentially gain control of vulnerable web servers.
India’s Computer Emergency Response Team (CERT-In) issued a critical alert on October 21, 2026, warning that attackers could exploit the vulnerabilities to execute commands on targeted systems and take complete control of them. The agency advised organisations and individuals using PHP to install the available security updates immediately.
The PHP security vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. Both have received a severity score of 9.2 out of 10 under the Common Vulnerability Scoring System, reflecting the serious risk they pose to affected systems.
PHP supports dynamic website functions, including user logins, online forms, database access and payment processing. It also underpins widely used platforms such as WordPress, Drupal and Joomla. Consequently, vulnerabilities in PHP’s core engine can expose websites even when their owners have not introduced errors into their own application code.
The flaws stem from problems in how PHP handles memory and certain failed requests. Under specific conditions, information left behind during request processing can be misused, allowing an attacker to execute unauthorised commands or access sensitive information stored in server memory.
Successful exploitation could enable criminals to steal confidential data, expose passwords, alter website content, disrupt services or use a compromised server to attack other systems on the same network.
The PHP development team released security updates on October 21, bringing forward the planned disclosure after details of the vulnerabilities surfaced online. The urgency increased as researchers and security providers reported attempts to exploit the flaws before and around the public disclosure.
Governments and organisations in the Netherlands, France, Finland, Denmark and Canada temporarily took some public-facing websites and digital services offline while security teams assessed their exposure and applied protective measures.
Section 2: AI helps researchers uncover long-standing security weaknesses
The PHP security vulnerabilities’ discovery has highlighted the growing role of artificial intelligence in cybersecurity research. Calif, a security firm participating in OpenAI’s Patch the Planet initiative, identified one vulnerability in August and reported it to PHP’s developers. Researchers at Wiz, a cybersecurity company owned by Google, independently identified the flaws and reported their findings later that month.
The research teams used AI models to analyse PHP’s code, identify weaknesses and develop working demonstrations of potential attacks. According to Wiz, AI-assisted analysis enabled a single researcher to complete work in approximately a week that might previously have required a team months to accomplish.
The findings demonstrate how AI can help security researchers identify weaknesses that have remained undetected in widely used software for years. They also raise concerns about the possibility of attackers using similar capabilities to identify vulnerabilities and develop exploits more quickly.
The researchers and software developers coordinated their response to prepare security updates before publicly disclosing the technical details. However, an online leak and the circulation of a video apparently demonstrating an attack disrupted the planned disclosure schedule, prompting the PHP team to release its fixes earlier.
Security providers also began deploying protective measures. Cloudflare reported that it introduced web application firewall protections before public disclosure and observed attackers modifying their requests to evade those defences. Its report described a rapid increase in exploitation attempts following the announcement, highlighting how quickly a newly disclosed vulnerability can attract malicious activity.
The incident illustrates a significant shift in cybersecurity: AI can strengthen defence by accelerating vulnerability discovery, but the same technology may also reduce the time and expertise required to develop attacks.
Section 3: Security updates become an immediate priority for PHP users
The PHP security team released fixes for supported versions, including PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Organisations should identify their PHP installations and upgrade to the appropriate patched release. Older versions that have reached the end of official support require particular attention because they may not receive standard security updates.
CERT-In has urged Indian organisations to apply the updates, although its alert did not establish whether Indian websites had already been compromised. The PHP security vulnerabilities’ widespread reach makes it important for businesses, government departments, educational institutions, healthcare providers and online retailers to assess their exposure.
Website owners should coordinate with their hosting providers because updating a content management system, theme or plugin alone does not necessarily fix a vulnerability in the underlying PHP runtime. Organisations using managed hosting should confirm that the provider has installed the appropriate security updates.
If immediate patching is not possible, administrators should follow official security guidance, assess the risks, and consider temporarily isolating vulnerable internet-facing systems. Temporary protective measures can reduce exposure but should not replace a complete security update.
Visitors do not need to install anything or change their devices simply because they access PHP-based websites. However, some websites may experience temporary outages while administrators carry out security work.
The incident reinforces the importance of maintaining supported software, applying security patches promptly, and monitoring systems for suspicious activity. As AI-assisted vulnerability research advances, organisations may need to respond faster to emerging threats and treat software maintenance as an essential part of cybersecurity rather than a routine technical task.
