The PHP maintainers released emergency security patches on October 21, 2026, one day ahead of schedule, after details of two critical remote code execution flaws leaked online. PHP powers about 70% of sites with a known server-side language. The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively called PHP2Shell, both carry a severity score of 9.2 out of 10. According to OpenAI president Greg Brockman, the underlying bug had existed in PHP for 14 years, and a limited version appeared in 2024 but was not considered significant at the time.
The public disclosure triggered urgent global action. Finland, the Netherlands and France pulled government websites offline, while the EU, the United States, Germany, Japan, Australia and the United Kingdom issued local warnings. Nintendo and other major organizations also took services offline to patch. Cloudflare CTO Dane Knecht said the company shipped stopgap mitigations, and CEO Matthew Prince reported that exploit attempts grew from thousands in the ten hours before the announcement to tens of thousands within 45 minutes, hundreds of thousands within two hours, and millions by Wednesday. Japan's Mitsubishi UFJ Financial Group and Finance Ministry suspended some internet services as a precaution.
OpenAI said its AI models found the bugs first. Security firm Calif used GPT-5.6 Sol under OpenAI's Patch the Planet program to uncover one version in August, while OpenAI found a fuller version in September. Wiz detected and reported both flaws independently. OpenAI spent two months leading a coalition of maintainers, researchers and security providers, including Wiz and Cloudflare, and engaged the Office of the National Cyber Director and CISA. Amazon's MadPot threat detection system also spotted exploitation attempts before public disclosure, though how attackers learned of the flaws remains unclear. Google said Wiz and its Gemini AI helped assess the vulnerabilities, test attacks and check patches.
The NSA urged PHP users to prepare updates immediately and said affected systems should be taken offline if they cannot be patched right away. The FBI warned that bad actors could remotely execute code and put sensitive data and networks at risk. Cybersecurity authorities in Singapore, the UK, Australia, Canada and the EU issued similar alerts. PHP's security team noted that about half of all PHP sites run older versions, and only PHP 8.2 and newer receive official releases, with minimal source backports published for PHP 7.4, 8.0 and 8.1. Sophos researcher Don Smith advised administrators to locate all PHP installations, which often hide under content management systems and hosting platforms, and take unpatched systems offline until secured.
