Two critical vulnerabilities in PHP have put web administrators and security teams on an urgent patching schedule. The PHP Foundation released emergency updates after warning that the flaws could give attackers dangerous access to affected systems.
The concern reaches beyond teams that know they run PHP directly. The language underpins websites and software across the internet, and older installations may still be present in infrastructure that has been forgotten or left unmaintained.
Why the vulnerabilities have broad reach
The PHP Foundation identified the flaws as CVE-2026-109618 and CVE-2026-109619. Its alert says they affect “all PHP installations serving web requests” going back to PHP version 5, released in July 2004.
PHP is used in web development and supports publishing systems such as WordPress and Drupal, as well as e-commerce platforms such as Adobe’s Magento. That wide use means organizations may need to check not only websites they built themselves, but also software and services that rely on PHP.
The Foundation says only PHP 8.2 and newer are still supported and will receive patches. Some PHP distributions and third-party vendors still produce fixes for older versions, but that does not mean every legacy installation will have an available update.
Lukasz Olejnik, an independent security consultant and visiting senior research fellow at King’s College London, described PHP’s reach as comparable to critical infrastructure. He warned that millions of systems could be affected and that rapid exploitation could lead to wormable malware spreading across large parts of the internet.
What attackers could do
According to security company Wiz, the vulnerabilities could allow unauthenticated attackers to execute code on affected servers or read sensitive process memory. That memory could contain passwords, authentication tokens, API keys, and certificates belonging to other requests or the server itself.
Longtime security and compliance consultant Davi Ottenheimer said the issue involves a file upload interface. In his account, an attacker might send a crafted upload to a server without first identifying the site or the software it runs. That possibility makes it harder for defenders to rely on obscurity as a safeguard.
Reports of activity added to the urgency. Cloudflare said it was seeing early attacks emerge before the vulnerabilities and fixes had been detailed. Security firm Sansec wrote ahead of the release that it expected mass attacks to start within 15 minutes of the fixes becoming available.
Wiz said its researchers discovered the vulnerabilities partly using AI tools. OpenAI and security firm Calif also said they independently discovered the issues and worked together. Wiz called its exploitation demonstration php2shell and said some cases could be exploited “fairly easily.”
Updates are the recommended response
The PHP Foundation’s advice is direct: “There are no complete mitigations, updating is the only safe choice.” The emergency fixes were released just before 10 am ET on Wednesday. Organizations should identify where PHP is running, prioritize systems connected to the internet, and apply the updates that are available for their versions.
Teams also need to check for software-company updates where PHP is embedded in an app or service. A server inventory may not reveal every PHP-dependent component, so the work can extend beyond systems managed directly by a web team.
Before the fixes were released, some organizations took websites offline as a precaution. Multiple Finnish government sites, including the National Land Survey, were inaccessible, according to reports. French government websites and the Port of Rotterdam’s website were also offline, according to Reuters.
The UK’s National Cyber Security Center advised organizations to prepare for immediate updating and consider taking a system offline if immediate remediation was not feasible. The EU’s Computer Emergency Response Team and Australia’s cybersecurity agency also urged IT teams to be ready to update systems as soon as possible.
Check for exposure and signs of compromise
After applying updates, organizations should continue monitoring internet-connected PHP systems for signs of exploitation. They should also watch for updates from vendors whose products include PHP, since patching the underlying language may not update every dependent application.
If an organization finds evidence of compromise, Brett Leatherman, the FBI’s cyber assistant director, advised isolating the system, preserving web server and PHP logs, and reporting it to a local FBI field office. Keeping those records can help identify the actors involved and warn other organizations.
The practical challenge is that PHP may sit in older or less visible parts of an organization’s infrastructure. With the Foundation describing updates as the only safe choice, locating those installations and checking their patch status are immediate priorities.