Critical PHP flaws put millions of websites at risk as exploit attempts emerge

In the span of a week, security researchers used three AI agents to help identify and chain the vulnerabilities, then test and validate the exploits—a job they say would have previously taken months.

Hackers are exploiting newly disclosed PHP vulnerabilities that could let attackers take control of enterprise web servers without a password, putting millions of websites and applications at risk.

Disclosed on October 21 , the two critical flaws affect PHP, the programming language behind platforms including WordPress, Drupal and Joomla. Researchers at security company Wiz demonstrated how attackers could remotely execute commands or steal sensitive information. The researchers used Google’s Gemini 4 Argon, OpenAI’s GPT-5.6 Sol and Wiz’s own AI agent, Atlas, to help identify the vulnerabilities, chain the bugs together and test and debug their approach until they developed a working exploit. Palo Alto Networks’ Unit 42 has since reported attacks in the wild, raising the urgency for businesses still running vulnerable systems.

“Critical PHP flaws may let attackers run commands without signing in. Patch now; isolate what cannot be fixed,” Mark Hughes , Global Managing Partner for Security Services at IBM Consulting, told IBM Think in an interview.

The vulnerabilities are especially dangerous because they affect the underlying PHP software rather than individual websites.

“PHP processes web requests before WordPress, Drupal, Laravel or other application code runs,” Hughes said. “All PHP systems serving web traffic need review.”

Palo Alto Networks identified more than 22.6 million publicly exposed instances that may be vulnerable to the flaws, although that figure does not represent confirmed infections.

The bugs, identified as CVE-2026-109618 and CVE-2026-109619 , involve errors in how PHP manages memory. Attackers could exploit them to run malicious code without valid credentials.

AI-powered cyberattacks are becoming a growing problem for businesses. According to IBM’s 2026 Cost of a Data Breach Report , AI-driven attacks increased 56% over the year, as criminals increasingly used AI-generated impersonations and malware to target organizations.

IBM Senior Vice President Rob Thomas warned on that AI is accelerating the discovery and exploitation of security flaws, leaving companies less time to respond. He pointed to IBM and Red Hat’s Lightwell , which combines AI with human expertise to fix vulnerabilities in open-source software without requiring major upgrades.

For enterprises, the challenge is identifying vulnerable PHP installations across websites, cloud services, containers and older infrastructure.

Hughes warned that Apache mod_php, a configuration running PHP inside the Apache web server, presents particularly serious risks.

The PHP project released security updates in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Organizations should patch immediately, verify that updated software is running and isolate systems that cannot be fixed.

Security teams should also investigate suspicious activity, including unexpected commands and outbound connections.

“It’s serious,” Hughes said. “Organizations need to act now. But they need to be systematic and get the patching done.”

Would your team catch the zero-day in time?

Join security leaders who rely on the Think for curated news on AI, cybersecurity, data and automation. Learn fast from expert tutorials and explainers—delivered directly to your inbox twice weekly. See the IBM Privacy Statement .

Protect secrets, manage machine identities and issue dynamic credentials for agentic AI and hybrid cloud.

Identify and prioritize vulnerabilities to strengthen security and reduce risk across your systems.

Identify, prioritize and manage remediation of security flaws to reduce exposure, strengthen defenses and support compliance.

Surface the vulnerabilities that matter most and guide teams through faster, more effective remediation to reduce risk and prevent breaches.

Explore Concert® application vulnerability management

Explore vulnerability assessment solutions