ANALYSIS
Security agencies around the world issue a global public warning leading to the shutdown of official websites
The NSA and European cybersecurity agencies are urging users to update PHP or take vulnerable systems offline after two remote code execution vulnerabilities were detected using artificial intelligence and details of the vulnerabilities were leaked prior to the official release of the patches.
Government agencies and companies in several countries took their websites offline on Wednesday as a preventive measure following the disclosure of two critical vulnerabilities in PHP, the open-source programming language that powers a very large portion of the web. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could allow an attacker to execute code on affected servers without requiring credentials.
The National Security Agency (NSA) urged organizations using PHP to immediately prepare the update and, if applying the patch is not possible, to keep their systems offline until the vulnerabilities can be fully mitigated. According to the agency, these vulnerabilities could provide "direct access" to the server's file system or database.
What are the vulnerabilities?
The PHP Foundation released on Wednesday the patched versions PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Both vulnerabilities are related to memory management and the handling of fatal errors in the language and can lead to remote code execution (RCE), one of the most serious categories of computer security flaws.
The first, CVE-2026-109618, occurs when a request reaches PHP's memory limit at a specific moment and leaves partially initialized internal data that the system may subsequently treat as valid. The second, CVE-2026-109619, can cause the global state to point to memory that has already been freed, which a subsequent process could maliciously reuse.
The PHP Foundation assigned each vulnerability a CVSS v4.0 score of 9.2 out of 10. The organization warns that all PHP installations serving web requests are potentially vulnerable, including configurations with Apache and mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed.
A global alert
The magnitude of the problem lies in the widespread use of PHP: the language powers approximately 70% of sites whose server language can be identified, according to the W3Techs crawler, and is behind platforms such as WordPress, Drupal, Joomla, and Magento.
Palo Alto Networks' Unit 42 identified more than 22.6 million internet-exposed instances that could be vulnerable.
Wiz Research, the cloud cybersecurity company owned by Alphabet, claimed that it had demonstrated, in controlled tests, the remote execution of code without authentication on WordPress, Drupal, and Joomla installations. The researchers also claimed to have been able to access sensitive information stored in the PHP process memory, such as passwords, authentication tokens, API keys, and certificates.
Cloudflare stated that it was detecting "early attacks" and deployed temporary rules on its web application firewall to block known exploitation vectors. The company emphasized, however, that these measures are a stopgap and do not replace the installation of the official patch.
AI, behind the discovery
The vulnerabilities were reported in August. The security firm Calif detected one of them using the GPT-5.6 Sol model from OpenAI's GPT-5.6 Sol model as part of the Patch the Planet program; OpenAI independently reported the same root cause issue on the same day, while Wiz reported the second vulnerability on August 24 and subsequently identified new exploitation vectors.
OpenAI described the discovery as "one of the most impactful security issues in recent times" and stated that it marks a new phase in which artificial intelligence can identify flaws with internet-wide consequences. The company also warned that these same capabilities could accelerate the development of offensive tools by malicious actors.
The main flaw had been present in the code for about 14 years, according to what OpenAI President Greg Brockman explained in X. A limited version of the problem had been detected in 2024, but the PHP Foundation acknowledges that a lack of resources and difficulties in choosing a compatible solution delayed the fix—an organizational failure that the foundation itself describes as "structural."
A leak brought the emergency forward
The coordinated disclosure was cut short two days before the scheduled date. On October 20, the identifiers for the two vulnerabilities began circulating on forums and social media, with an incorrect severity score—10.0 instead of 9.2—and without technical details.
The PHP Foundation then brought forward its announcement and moved the release of the patch from October 22 to October 21 at 2:00 p.m. UTC. Hours before the official release, the company Chainguard broke the embargo and distributed images containing the fix, which, according to the foundation, may have allowed attackers to analyze the fix before most administrators had access to it.
Public websites down
In France, the Ministry of the Interior confirmed that several local government websites, including that of the Paris Police Prefecture, became inaccessible starting Wednesday afternoon at the request of the French National Cybersecurity Agency, following the detection of a critical vulnerability.
In the Netherlands, the national digital identity service DigiD, the House of Representatives' website, and the National Cybersecurity Center's website were taken offline as a precautionary measure, according to the public broadcaster NOS. Preventive outages also occurred in Finland, Denmark, and Belgium, while cybersecurity agencies in Australia, Japan, and the United Kingdom recommended urgently updating or isolating exposed services.
What administrators should do
The CISA, the leading U.S. cybersecurity agency, recommended applying the patches, but noted that it had not observed any exploitation of the vulnerabilities at the time of publishing its advisory.
If an immediate update is not feasible, CERT-EU advises isolating PHP-based applications from public networks until the fix can be applied. The Australian Cyber Security Center adds that organizations should monitor their systems for suspicious activity, although at the time of its advisory, it was not aware of any active exploits in Australia.
🛠 Do you think there is an error in this article?
Recommendations
LATEST
