Security researchers using AI models, including an OpenAI-linked group and Google-owned Wiz, discovered critical vulnerabilities in the PHP programming language that have existed for roughly 20 years. The flaws triggered outages or precautionary shutdowns at 4chan, DeviantArt, Wikipedia, Pokémon Home, Pokémon Champions, and some Dutch and Finnish government sites, while the NSA and UK's National Cyber Security Centre urged organizations to take systems offline if they couldn't patch immediately.
theverge.com
· 2026-10-21
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were released to fix CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities that could let unauthenticated attackers execute code on servers running PHP. One flaw involves memory corruption triggered when a request hits the memory_limit at a precise moment, while the other involves stale internal state left behind after a fatal error, both of which were shown to enable full remote code execution under common configurations like Apache with mod_php and PHP-FPM.
thephp.foundation
· 2026-10-21
PHP issued an emergency security update fixing two critical vulnerabilities that let attackers run arbitrary code on vulnerable servers, affecting software behind Drupal, Magento, Joomla and WordPress. Researchers at Wiz, who helped discover the bugs along with OpenAI, say every PHP version released in the past decade contains at least one flaw, and Cloudflare and Reuters reported active exploitation and government site outages following disclosure.
krebsonsecurity.com
· 2026-10-21
The PHP project has signaled that it intends to release two emergency patches in the near term, according to a notice from its maintainers. Specific details about the vulnerabilities or bugs being addressed were not disclosed in the announcement.
tech.slashdot.org
· 2026-10-21
PHP's maintaining agency disclosed two critical vulnerabilities on Tuesday, with fixes scheduled for release Wednesday at 10 a.m. ET. The flaws, rated 9.2 out of 10 in severity, could let attackers compromise websites built on PHP, which the Wall Street Journal estimates powers 70% of the internet. Agencies including the NSA and UK's NCSC urged administrators to patch immediately or take sites offline, while Cloudflare said it had deployed a firewall fix and security firm watchTowr reported early signs of exploitation attempts.
cnet.com
· 2026-10-21
The PHP Foundation released emergency updates on Wednesday to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could let attackers remotely take control of affected systems. The flaws affect all PHP installations serving web requests dating back to PHP 5 from 2004, though only PHP 8.2 and newer will receive official patches, with some legacy fixes available through third-party vendors.
wired.com
· 2026-10-21
Security researchers at Calif.io, Wiz, OpenAI and Quarkslab disclosed two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, dubbed php2shell, affecting all web servers running PHP 5.4 or later. Cloudflare says it deployed WAF protections for free and paid customers by October 21 at 3:02 am UTC, roughly nine hours before the public disclosure, after coordinating with the PHP Foundation, OpenAI and Wiz.
blog.cloudflare.com
· 2026-10-21
Researchers disclosed PHP2Shell, a set of memory-safety vulnerabilities in PHP's core, covering two CVEs related to out-of-memory corruption and stale global state persisting across requests. The flaws affect any site running vulnerable PHP versions, even simple applications with secure code, and are not tied to any specific CMS. WordPress, Drupal and Joomla were used only as demonstration targets for unauthenticated remote code execution, and the PHP team has released fixes.
php2shell.com
· 2026-10-21
The PHP project has released updates 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could let unauthenticated attackers achieve remote code execution. The flaws stem from out-of-memory handling and stale global state issues affecting PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed deployments. PHP versions 8.1 and earlier no longer receive official fixes, so users on those versions must seek vendor backports or upgrade.
php.net
· 2026-10-21
Wiz Research disclosed multiple critical vulnerabilities in the core PHP engine, grouped under two CVEs with severity up to CVSS 9.2, which could let attackers remotely execute code, disclose memory, steal data or deface sites without authentication. PHP, which underpins roughly 70% of websites including WordPress, Joomla, Drupal and MediaWiki, has been affected since version 5.4, and a patch was released on October 21, 2026 following a coordinated cross-industry disclosure effort.
wiz.io
· 2026-10-21
Researchers found eight intermediate certificates from India's eMudhra with private keys weak enough to be guessed in at most 256 tries, some with as few as 3-8 bits of entropy instead of 384. These certificates chained to roots trusted by major browsers and operating systems, meaning anyone with a key could impersonate any website. Separately, two critical PHP vulnerabilities became public before patches were ready, leaving servers exposed in the interim.
techspot.com
· 2026-10-21
The Dutch National Cyber Security Center (NCSC) temporarily took its website NCSC.NL offline as a precaution due to vulnerabilities discovered in PHP. The organization says it is awaiting a security patch from the PHP security team, expected at 16:00 Dutch time, after which it plans to publish an advisory within an hour. The NCSC has also set up a GitHub page with technical details and is compiling an inventory of PHP-related software products affected by the flaws.
ncsc.nl
· 2026-10-21
GoKawiil