PHP Rushes Out Patches for Two Critical Bugs as Officials Urge Sites Offline

The developers of PHP, the programming language that runs a large share of the world’s websites, released emergency security updates on Wednesday for two critical flaws that could let attackers take control of web servers, and government cybersecurity agencies on both sides of the Atlantic urged anyone who could not patch quickly to take their sites offline.

The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, allow remote code execution without any login. Both stem from the same underlying weakness: PHP can leave its memory in a corrupted state when a web request ends abnormally, which an attacker can exploit to run commands with the permissions of the web server, BleepingComputer reported. The PHP team said servers using the Apache module mod_php face the highest risk, with a demonstrated attack that works before any website code runs.

Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The project offered minimal fixes for older 7.4, 8.0 and 8.1 branches to people who build PHP themselves, but versions 8.1 and earlier no longer receive official updates, leaving many older systems dependent on outside vendors.

The scale is large. The web survey firm W3Techs says PHP is used by about 69 percent of websites, and the internet scanning company Censys counted nearly 55 million web properties running PHP as of Wednesday, NBC News reported.

OpenAI said it helped discover the flaws through a program that gives cybersecurity companies access to its models, and called the problem one of the most impactful security issues in recent memory. BleepingComputer credited researchers from Calif, OpenAI and Wiz with the discovery.

The rollout was rocky. PHP warned administrators on Tuesday to prepare for emergency updates and said it would publish early if details leaked. The PHP Foundation said the company Chainguard shared details of the patch about six hours before release, breaking an agreed embargo and making it easier for attackers to work backward from the fix, NBC reported. Cloudflare said it had put temporary protections in place and was already seeing early attacks.

Officials responded with unusual bluntness. The National Security Agency raised the possibility of taking sites offline, and the Cybersecurity and Infrastructure Security Agency urged immediate patching, though it said it had not yet observed exploitation. Britain’s National Cyber Security Centre advised taking systems offline where immediate fixes were not possible, and the European Union’s cybersecurity team told organizations to consider isolating internet-facing applications. Several well-known sites, including the bookmarking service Pinboard and parts of Wikipedia, went offline temporarily.

Reports of attacks were mixed on Wednesday. The security firm Patchstack said it had reports of active exploitation and Cloudflare said it was seeing early attempts, while CISA said it had not observed exploitation as of its advisory. Silas Cutler of Censys told NBC it could take days to learn how many servers were compromised before they were patched.