PHP fixes two critical flaws, governments and sites go offline
Archived — this story has rotated out of today’s deck. It is kept here in full.
The gist
The PHP development team released updates fixing two critical vulnerabilities rated 9.2 out of 10.
PHP powers nearly 70% of the internet, so agencies urged immediate patching.
Background
PHP is a programming language released over 30 years ago, estimated to power nearly 70% of the internet, including WordPress, which runs more than 40% of websites. It is maintained by the PHP Foundation, a nonprofit. The two flaws had been present for decades, but proving they were exploitable required a chain of steps described as being at the edge of what human researchers could practically achieve. The vulnerabilities were found by cybersecurity experts with the help of AI models, and the rush to patch them drew warnings from governments and security agencies worldwide.
How it unfolded
- Aug 11, 2026Researchers at security firm Calif, working with OpenAI, reported the first flaw.
- Aug 24, 2026Wiz, a security firm owned by Alphabet, reported the second vulnerability.
- Oct 20, 2026The PHP Foundation announced an upcoming security release addressing two critical vulnerabilities in PHP.
- Oct 21, 2026The PHP development team released updates fixing two critical vulnerabilities that can allow unauthenticated remote code execution, and strongly encouraged all users to update immediately. The vulnerabilities were rated 9.2 out of 10 under CVSS v4.0.
- Oct 21, 2026Several websites were temporarily down as of Wednesday morning, including Pinboard and some parts of Wikipedia. CISA said it had not observed exploitation of these vulnerabilities as of the time of publication.
- Oct 22, 2026Authorities in Europe, Asia and other continents temporarily took some government websites offline; Germany's digital ministry and France's interior ministry were among those acting as a preventative measure, and Belgium, the Netherlands, Finland and the Czech Republic said they had shut down sites to apply a patch.
- Oct 22, 2026Popular Irish news website The Journal was temporarily offline Thursday morning while it bolstered its defences.
Who’s saying what
- Official
- The PHP development team said the updates fix two critical vulnerabilities allowing unauthenticated remote code execution and that all PHP users are strongly encouraged to update immediately.
- Official
- CISA and the FBI Cyber Division urged organizations to immediately patch, with the FBI recommending systems be taken offline if an immediate update is not feasible.
- Analysts
- Wiz said the findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history.
- Expert
- SentinelOne's Andrés Guerrero-Saade said the incident illustrates how AI is accelerating vulnerability researchers' ability while also boosting bad actors' capacity to exploit flaws.
Still unverified
CISA said it has not observed exploitation of these vulnerabilities as of the time of publication; Censys estimated about 1.5 million of 2.6 million hosts scanned were running an unpatched PHP version.