A pair of critical PHP security flaws discovered by researchers with the help of AI forced an emergency patch and set off scattered attacks across the web. PHP is a programming language used to build up to 70 percent of the websites online today.
Mashable reports that the PHP team pushed out emergency fixes on Wednesday for two critical vulnerabilities, moving up the release to 10:00 a.m. ET after someone leaked flaw details a day ahead of schedule. The fixes had originally been planned for a coordinated release later in the week, giving companies time to prepare, according to the facts of the case. Once the leak happened, that plan fell apart. The flaws were reportedly found by researchers using AI to probe the popular web technology.
PHP is the server-side programming language running countless content management systems, online stores, custom web services and other products. That’s why a flaw in it tends to spread fast. The two bugs, tracked as CVE-2026-109618 and CVE-2026-109619, could let an attacker remotely take over a server without ever logging in. The attack overloads PHP’s memory to corrupt it, then exploits that corruption to seize control under certain conditions. One of the flaws specifically involves how PHP handles form submissions and file uploads. Researchers have taken to calling the pair “PHP2SHELL.”
PHP rated each flaw 9.2 out of 10 on the industry’s standard severity scale. Others went further: security firm watchTowr called them a perfect 10, according to BleepingComputer, and an anonymous Hacker News post made the same claim before it was deleted. watchTowr CEO Benjamin Harris told BleepingComputer the vulnerabilities affect PHP versions 5 through 8, and said his firm had reproduced one of the two flaws, calling the threat “indeed real.”
As of Tuesday, watchTowr said it hadn’t seen anyone actually exploiting the bugs. That changed fast. By Wednesday, Cloudflare Chief Technology Officer Dane Knecht said on X that the company was already seeing early attacks, BleepingComputer reported. Cloudflare has since added emergency firewall rules to block suspicious requests tied to the flaws, and the protection is available to all customers, including those on free plans.
The UK’s National Cyber Security Centre urged organizations to install the fix immediately. The agency said any organization running PHP 5 or later is affected and should update to the latest fixed version, while those stuck on older, unsupported versions should migrate to one that’s still supported. The NCSC’s advice: find every system running PHP, starting with anything internet-facing; watch for vendor updates; take systems offline if they can’t be patched quickly; and check unpatched systems for signs they’ve already been compromised.
For ordinary people browsing the web, there’s nothing to install. The responsibility falls on website operators and hosting providers to patch their systems.
Read more at Mashable here.
Lucas Nolan is a reporter for Breitbart News covering issues of AI, free speech, and online censorship.
