Tech and AI

Two critical PHP flaws found with AI push governments and companies to take websites offline until they can patch

By Staff Writer  |  22 October 2026

Fixes for the two bugs in the language behind most of the web arrived on Wednesday, after security agencies in the UK, the US, the EU and Australia told site owners who could not update at once to consider pulling their systems off the internet.

Governments, public bodies and companies took websites offline on Wednesday while they waited to patch two critical flaws in PHP, the programming language that runs on the servers behind a large part of the internet. The bugs, logged as CVE-2026-109618 and CVE-2026-109619, carry a severity score of 9.2 out of 10 and can let an attacker run code on an unpatched site without logging in.

PHP's security team warned users on Tuesday evening to prepare, after details of the flaws began to leak on social media. PHP's maintainers released the fixes on Wednesday. They cover PHP 8.2 and later only: version 8.1 and older no longer receive updates from the project, so sites still on those versions have to upgrade before they can be protected.

Sites pulled while the fix was awaited

The UK's National Cyber Security Centre told organisations that where immediate remediation was not feasible, they should consider taking the system offline until it could be fully mitigated. The US National Security Agency gave similar advice, and EU and Australian officials urged PHP users to apply the fixes.

Finland temporarily shut down the government's public web services. In the Netherlands the national cyber security agency took its own website down, and the sites of the National Institute for Public Health and the Environment and of the Tweede Kamer, the lower house of parliament, became unreachable. Among companies, Nintendo took services offline while it dealt with the bugs, and other large sites pulled systems as a precaution.

Dane Knecht, chief technology officer of Cloudflare, said the company was already seeing early attacks and was updating its defences as new methods appeared.

The use of PHP is pervasive, it can sit beneath public websites, content management systems, hosting platforms and third-party products, sometimes without even being obvious to the organisation using it.

Don Smith, Sophos Counter Threat Unit

Found with AI, years after the first warning

The flaws were found by researchers at the security firms Calif and Wiz, Calif working through Patch the Planet, a programme run by OpenAI that gives researchers access to its advanced AI tools to find and fix flaws. By the PHP Foundation's account, published on Wednesday, a Calif researcher reported the bugs on 11 August. OpenAI and the security firm Trail of Bits also found the same problems during audits of PHP.

The foundation also said the history of one of the bugs goes back to an external security audit in 2024. Its security team, which works by consensus, struggled to choose between fixes that each risked breaking compatibility or third-party extensions, and work on a fix stalled and restarted over months. Both flaws, it said, sit in parts of PHP that nearly every request touches.

Wiz estimates that roughly 70 per cent of the internet is affected. The figure that matters to a site owner this week is shorter: which of their servers run PHP, and whether any of them run a version that will never receive this fix.