The National Security Agency and FBI are telling organizations running the PHP programming language to patch two newly disclosed security flaws immediately, warning that the bugs give attackers a direct path into a server's file system or database without even needing a password. The flaws affect software underpinning a massive share of the internet, and officials say the risk is serious enough that some government websites have already gone dark as a precaution while fixes are applied.
NSA Cyber advised organizations using PHP to prepare for an update addressing the two critical vulnerabilities, warning that they can provide attackers a direct path to a server's file system or database, according to KRON4. If an immediate update is not feasible, the agency recommended taking affected systems offline until they are fully mitigated. The warning echoes guidance from the FBI and NSA reported separately by the Associated Press, which flagged the vulnerabilities in the widely used web programming language.
PHP is frequently described as the backbone of the web, a scripting language that powers major platforms including WordPress and Wikipedia's MediaWiki software, per KRON4's reporting. The FBI Cyber Division urged organizations to act quickly, monitor web services for suspicious activity, and report any signs of compromise to a local FBI field office or the Internet Crime Complaint Center, the outlet's report states.
Two Flaws, Both Rated Near-Maximum Severity
The PHP project released fixes on Wednesday for versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, addressing vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, according to CERT-EU. Both carry a CVSS severity score of 9.2 out of 10 and can allow unauthenticated remote code execution, the European cybersecurity agency says. CVE-2026-109618 stems from memory corruption during out-of-memory handling, while CVE-2026-109619 arises from stale global state, per CERT-EU's advisory.
Every PHP installation that serves web requests is considered at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed configurations, CERT-EU notes. The agency advises organizations to patch affected assets immediately, and if that isn't possible right away, to isolate internet-facing applications from public networks until a fix is applied and verified. CERT-EU also notes that PHP 8.1 and older branches are end-of-life and no longer receive updates from the PHP project at all.
The scale of potential exposure is enormous. Censys identified 6,292,667 hosts and 115,000,393 web properties matching its PHP exposure queries as of Wednesday, according to the firm's security advisory. The PHP project has confirmed working attacks for each flaw on different server setups, Censys reports, and states that updating is the only complete fix, while recommending that organizations review any internet-reachable unpatched hosts for signs of compromise.
Some Sites Already Going Dark, Early Attacks Reported
Unit 42 researchers at Palo Alto Networks say they have observed proof-of-concept exploit code for both vulnerabilities, and report that at least one European government has already taken its website offline as a precaution, according to the firm's threat brief. Accounts differ on whether active exploitation has been confirmed. Cloudflare CTO Dane Knecht said the company is seeing early attacks emerging and is updating its mitigations as new attack vectors appear, while the security firm watchTowr says it has reproduced both vulnerabilities and is observing exploitation attempts, per reporting from Tenable. By contrast, the federal Cybersecurity and Infrastructure Security Agency said it had not observed exploitation of the vulnerabilities as of the time its advisory was published, according to NBC News.
Security firm Wiz ranked the findings among PHP's most severe vulnerabilities, and arguably among the most severe in the history of malware, KRON4 reported. Wiz researchers have said frontier AI models substantially reduced the difficulty of demonstrating that long-standing PHP flaws could actually be exploited, according to the firm's own analysis. Estimates of the overall impact vary: Wiz has put the figure at roughly 70% of the internet, though the BBC said it was unable to independently verify that number in its own coverage.
AI's Role in Finding the Bugs
Artificial intelligence was credited with identifying the vulnerabilities in PHP, according to the article's reporting. OpenAI president Greg Brockman said the underlying bug had been present in the code for 14 years, and wrote that OpenAI led a coalition for two months to mitigate the severe open-source software flaw, per the same report. Security researchers reportedly discovered a limited version of the bug back in 2024, though it was not deemed significant at the time; a fuller version of the vulnerability was later found in August 2026 using OpenAI's GPT-5.6 Sol model, with researchers working alongside an OpenAI initiative during that period, the report states.
That initiative, described by OpenAI as Patch the Planet, pairs AI tools with human oversight. Security engineers reviewed every finding before it reached a maintainer, according to OpenAI's own account of the effort. Trail of Bits security engineers worked full-time with Codex and GPT-5.5-Cyber across 19 open-source projects, identifying hundreds of security issues and merging dozens of patches, OpenAI says. The company also released a PHP version checker within Codex to help operators identify potentially vulnerable PHP installations.
If exploited, the vulnerability allows attackers to execute code on nearly all deployed PHP applications, letting them exfiltrate private user data or modify websites outright, per the reporting attributed to the article. AI developers have touted AI's ability to identify security vulnerabilities faster than humans or traditional computer systems, but they have also warned that the same detection tools can be turned around and used by bad actors.
How Big Is PHP's Footprint, Really?
Just how much of the web runs on PHP depends on which measurement you trust. W3Techs reports that PHP is used by 69.3% of all websites whose server-side programming language is known, according to the firm's October 2026 data, while other reporting has cited figures closer to 69% or 70% of all websites worldwide. Those figures rely on different denominators and shouldn't be treated as directly interchangeable, but the common thread across every account is the same: PHP sits underneath an enormous share of the sites people visit every day, from blogs to government portals, which is precisely why security agencies on both sides of the Atlantic are pushing so hard for immediate patching.
