A pair of severe cybersecurity flaws affecting the foundational web scripting language PHP has prompted emergency alerts from intelligence and cyber defense agencies worldwide, with officials advising administrators to disconnect vulnerable servers if they cannot install fixes immediately.
The two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively nicknamed PHP2Shell, carry a critical severity rating of 9.2 out of 10. The flaws enable unauthenticated remote attackers to execute arbitrary code or extract sensitive server memory without entering login credentials, according to advisories published Wednesday by the PHP Foundation and security researchers.
Flaws Hidden Since 2004
PHP is an open-source programming language that powers roughly 70 percent of the internet, representing tens of millions of websites and powering major content platforms such as WordPress and Drupal. The underlying errors date back to PHP version 5, which debuted in July 2004, Help Net Security and WIRED reported.
The vulnerabilities were identified independently by cybersecurity company Wiz, which is owned by Google, and a testing team named Calif collaborating with OpenAI. Researchers leveraged artificial intelligence systems, including OpenAI’s GPT-5.6 Sol and Google’s Gemini 4 Argon, to discover the flaws and demonstrate that remote exploitation was feasible.
While the complex technical chain required to trigger the exploit was previously considered near the outer boundary of what human researchers could achieve, frontier AI models dramatically lowered that barrier, Wiz researchers said in findings cited by Help Net Security. OpenAI noted in a blog post that while AI helps uncover internet-scale vulnerabilities, those same capabilities can assist malicious hackers in assembling offensive exploits.
Urgent Calls to Patch or Disconnect
The PHP project released patched versions on Wednesday morning, specifically PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Although earlier versions such as PHP 8.1 and PHP 7.4 reached end-of-life status years ago, the team issued minimal source code backports due to the extreme danger posed by the bug.
Government authorities quickly reacted to the disclosure. The U.S. National Security Agency, the FBI, the U.K. National Cyber Security Centre, and cybersecurity authorities in Australia and the European Union warned organizations to update immediately or take exposed systems off the internet until remediations are applied.
“If you find signs of compromise, isolate the system, preserve your web server and PHP logs, and report it to your local FBI field office,” Brett Leatherman, the FBI’s cyber assistant director, wrote in a public post reported by WIRED.
Early Disruptions and Attacks
Precautionary shutdowns occurred across Europe ahead of the public patch release. Government websites in France and Finland, including Finland’s National Land Survey, as well as the Port of Rotterdam’s public portal, were temporarily taken offline, WIRED reported.
Infrastructure provider Cloudflare deployed protective firewall rules across all customer accounts on Wednesday morning. However, threat intelligence firm watchTowr reported observing active attempts in the wild to trigger the vulnerabilities, though successful breaches had not yet been confirmed as of Wednesday morning, CNET reported.
Because millions of legacy and unmaintained servers run unmanaged web applications, security analysts anticipate a protracted recovery. Website operators running modern distributions must coordinate with web hosting providers and software vendors to ensure their installations run the updated releases.
