Recently, with the help of artificial intelligence (AI) tools, global cybersecurity agencies have discovered two serious security vulnerabilities in the commonly used server-side scripting language PHP. This has caused a significant impact on the internet in several countries.
The PHP development team originally planned to complete the bug fixes later this month. However, the security vulnerabilities were disclosed ahead of schedule on October 20 local time. Many websites are now at risk of being attacked, and several countries have had to temporarily shut down some government website. The PHP development team released an emergency update on October 21 local time to fix these two critical vulnerabilities.
PHP is a server-side scripting language used to dynamically generate web content on servers and send it to users' browsers. Not all websites use PHP, but it provides support for a large portion of websites worldwide.
In August this year, the cybersecurity company Calif used the GPT-5.6 Sol model developed by American company OpenAI to identify two high-risk vulnerabilities hidden in PHP code libraries. At the same time, Wiz, a cybersecurity company under Google's parent company Alphabet, reported that its research team used proprietary tools called Wiz Atlas and the Google Gemini 4 Argon model to discover these vulnerabilities.
These two vulnerabilities have numbers CVE-2026-109618 and CVE-2026-109619, respectively. They can allow unauthenticated remote attackers to trigger memory errors and achieve remote code execution by constructing abnormal HTTP requests, thereby gaining control of the server. Wiz indicates that these two high-risk vulnerabilities have been hidden in the PHP code library for over ten years, but they have never been discovered.
The British Broadcasting Corporation (BBC) stated that in order to address this issue, the PHP development team worked on fixes in confidentiality. It was originally planned to officially disclose relevant information and release an update later this month. However, on October 20th, details about two security vulnerabilities were leaked on social media, posing a risk of cyber attacks.
The PHP development team released an emergency update on the 21st local time, fixing these two security vulnerabilities. However, since some hackers had already launched cyberattacks before the update attempt, many European countries that heavily rely on the PHP language had to take "preventive measures." They temporarily closed some government websites before the update was released to reduce security risks.
Reuters reported that the Dutch cybersecurity department temporarily shut down services. The websites of five major political parties in the Netherlands, some government portals, and the Rotterdam Port website were also temporarily closed. Finland was affected more broadly, with the Finnish government's public network services being forced to shut down. The French Interior Ministry also stated that all its websites were placed in a "preventive maintenance mode."
However, the release of a patch does not mean that the problem is resolved. Cybersecurity expert Don Smith said, "PHP is widely used and can be found on public websites, content management systems, hosting platforms, and third-party products. Sometimes, even the organizations using it may not be aware of this issue. Organizations must closely monitor signs that attackers may have gained a foothold."
The European Union Computer Emergency Response Team stated that all versions of PHP starting from PHP 5 released in 2004 may be affected. However, the PHP development team has currently only released updates for the latest version. Versions such as PHP 8.1 and earlier will not receive official updates, and the official support only provides source code patches that need to be compiled by users themselves.
Some old PHP websites that are not maintained, as well as small websites with limited technical resources, also face risks. Experts warn that small PHP websites operated by individuals or organizations with limited resources often use shared hosting. Website owners cannot directly manage the servers, and such websites may not be able to fix vulnerabilities through automatic updates.
In addition, since the patches developed by the PHP development team have been made public, hackers may use AI tools to reverse engineer the vulnerabilities and quickly locate the flaws. Cybersecurity experts warn that this could lead to websites that have not yet been updated to fix these vulnerabilities being attacked.
