PHP Bug Causing Widespread Alerts From Government Agencies

GRAND RAPIDS, MI. - Government agencies, globally, issued alerts following the discovery of two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, in the widely used PHP programming language. These flaws, collectively termed "PHP2Shell," allow for unauthenticated remote code execution on web servers. On October 21, 2026, the FBI's cyber division warned about these vulnerabilities, which pose a risk of sensitive data and networks becoming compromised. National cyber agencies, including the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the UK's National Cyber Security Centre (NCSC), the European Union's CERT-EU, and the Australian Cyber Security Centre (ACSC), directed web administrators to apply updates immediately or take public-facing pages offline. Several government websites, including the Finnish government's, temporarily went offline as a precautionary measure.

Artificial intelligence tools from Google-owned Wiz, Calif, and OpenAI's GPT-5.6 Sol model assisted in uncovering these decades-old flaws, which human researchers found complex to locate through conventional testing. The PHP Foundation, which includes developers securing the language, released emergency security updates on October 21, 2026, addressing the vulnerabilities in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP powers approximately 70% of websites where the server-side programming language is known, impacting a significant portion of the internet's business and commercial infrastructure.

Cybersecurity experts warn that the public disclosure of these vulnerabilities and the capability of AI tools to reverse-engineer the bug create a "race to exploit" scenario for hackers. The National Security Agency (NSA) advises organizations to take systems offline if immediate patching is not feasible, emphasizing that these vulnerabilities provide a direct path to server file systems or databases. Organizations must identify all systems running PHP, prioritize internet-facing assets, and continuously monitor for security updates from third-party software vendors, as PHP often integrates into other products. Cloudflare reports detecting some exploitation of the flaws and implemented web application firewall rules to protect customers.