Back Computerweekly

What to do as critical PHP flaws puts millions of websites at risk

Computerweekly • October 21, 2026

Two critical vulnerabilities in PHP – the server-side language behind much of the public web – allow unauthenticated remote code execution (RCE) on affected servers. Emergency patches landed on Wednesday 21 October, but they cover only PHP 8.2 and newer, leaving a long tail of older sites exposed.

The UK's National Cyber Security Centre (NCSC) described a vulnerability that would allow an attacker to trigger an out-of-memory condition that corrupts memory and, under certain conditions, achieve unauthenticated remote code execution. In other words, the attacker gets a shell on the server and a direct path to the file system and the database.

PHP is a free, open-source, server-side scripting language created in 1994. It runs on the web server, not in the browser, to assemble page content, talk to databases and run backend logic before delivering finished HTML to a user. It sits beneath the content-management and e-commerce systems most organisations rely on, which is why the blast radius is so wide.

Identify every system running PHP, prioritising internet-facing systems. Do not limit discovery to outdated versions – all versions may be affected.

Update to the latest fixed version of PHP (8.2.35, 8.3.36, 8.4.27 or 8.5.12) and monitor for further updates.

For PHP 8.1 or older, your distribution or long-term support vendor for a backported fix, or upgrade to a supported version.

If you cannot patch, apply the PHP Team's temporary mitigations, or take the system offline until it can be fully mitigated.

Before upgrading an unpatched system, check for evidence of compromise and backdoors.

The two flaws – CVE-2026-109618 and CVE-2026-109619 – each carry a severity rating of 9.2 out of 10 and affect every release dating back to PHP 5 in 2004. PHP powers roughly 24 million websites, according to BuiltWith , and three-quarters of all sites whose language can be identified, according to W3Techs .

The vulnerabilities went undetected for more than a decade and were found using artificial intelligence (AI). Security firms Wiz and Calif used OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon to locate and verify them, coordinating with the PHP team before disclosure.

Official bodies around the world told organisations to act immediately. "Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated," the UK’s NCSC said.

The US National Security Agency (NSA) warned: "These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommended that organisations take the system offline."

The EU's CERT-EU offered similar advice, telling operators to "consider isolating internet-facing applications from public networks until a fix can be applied" where remediation could not happen at once.

Companies and organisations affected

Wikipedia (Wikimedia Foundation) and the WordPress, Drupal, Joomla, Magento, phpBB, MediaWiki, Laravel, Symfony and WHMCS ecosystems

UK: Edinburgh Council and several BBC programme pages, including Doctor Who and The Traitors

Finland: government public web services (Valtori)

Netherlands: NCSC-NL, the Port of Rotterdam, Overheid.nl, the KNVB, several hospitals and the Tweede Kamer

France: Interior Ministry websites

Denmark: Kombit, including the national school communication platform

Japan: Sakura Internet suspended a database appliance function

DeviantArt and other consumer sites reported downtime

The impact was immediate and global. Finland's state IT provider Valtori took government public services offline "as a precautionary measure". In the Netherlands, the National Cyber Security Centre pulled its own site, alongside the Port of Rotterdam, the Overheid.nl portal, the KNVB football association and several hospitals. France's Interior Ministry placed all its sites into preventive maintenance, Denmark's Kombit shut down several services, and in the UK, Edinburgh Council and several BBC programme pages went dark.

Wikipedia , operated by the Wikimedia Foundation, said it had taken down an unspecified number of systems until they could be patched.

On 's r/PHP and r/technology forums, practitioners flagged the practical realities of the fix. Administrators running older PHP 7.x sites – a large of the WordPress estate – reported waiting on backported fixes from Linux distributions, while others noted cloud platforms such as AWS Elastic Beanstalk had yet to ship the update. Several argued the long tail of unmanaged sites would take months to patch.

Early August 2026 – a security researcher first flags the issue

Friday 16 October – the White House says it was first made aware of the flaw

20 October – PHP maintainers publish an advisory for two 9.2-severity vulnerabilities, with patches scheduled 12 hours later

20–21 October – purported exploit details and a "PHP2Shell" video leak, showing remote code execution on WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symfony, Drupal and WHMCS

Wednesday 21 October, 13:34 UTC – source fixes land in the php-src GitHub repository and patches begin rolling out

Wednesday 21 October – NCSC, NSA, CERT-EU and agencies in Australia and Japan urge patching or takedowns; Finland, the Netherlands, France and Denmark take sites offline

Why websites need to assess the Wikimedia attack : We look at what a recent attack on Wikimedia means for website operators and how to harden public-facing web infrastructure.

Commvault users told to patch two RCE exploit chains : We examine a pair of remote code execution flaws that could be used to target on-prem customers with ransomware.

PHP2Shell: 22M exposed servers at risk as emergency patches released By: James Walker

Why websites need to assess the Wikimedia attack By: Cliff Saran

Cyber authorities issue alerts over exploitation of Citrix vulns By: Alex Scroxton

Apple addresses multiple WebKit vulnerabilities By: Alex Scroxton

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical PHP Vulnerabilities PHP2Shell Prompt Urgent Global Response On October 21, 2026, the PHP Foundation disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS scale. These vulnerabilities allow unauthenticated remote code execution (RCE) on affected servers, impacting millions of websites powered by PHP, including major platforms like WordPress and Joomla. The flaws stem from memory management issues in PHP's core, which have existed for over a decade. Following the leak of details on October 20, organizations were urged to patch immediately or take their systems offline. Emergency patches were released for PHP versions 8.2 and above, but many older versions remain vulnerable. Reports indicate that exploitation attempts began shortly after the vulnerabilities were disclosed, raising concerns about widespread attacks. Cybersecurity agencies worldwide have advised immediate action to mitigate risks. 83 sources 75

Extracted Entities

What to do as critical PHP flaws puts millions of websites at risk

The full story

Extracted Entities

Attack Types (1)

Companies (6)

Countries (5)

CVEs (2)

Domains (1)

Platforms (10)