PHP Security Flaws Trigger Global Cybersecurity Emergency as Hackers Launch Attacks

The global cybersecurity community has been placed on high alert following the discovery of two critical vulnerabilities in PHP, one of the programming languages widely used to operate websites and web applications. The vulnerabilities, collectively referred to as PHP2Shell, could allow attackers to remotely execute malicious commands on vulnerable servers without requiring passwords or authentication. The security flaws became public on October 21, 2026, prompting government agencies, technology companies and cybersecurity organisations to begin emergency updates. According to Reuters, the discovery triggered precautionary shutdowns of several government websites and online services across Europe and other regions as administrators worked to protect their systems. The incident has demonstrated how a vulnerability in widely used software can create security risks across multiple industries.

The vulnerabilities affect PHP’s underlying software infrastructure rather than a particular website or application. PHP is used by major content-management platforms and web technologies, including WordPress, Drupal, Joomla and Magento. Researchers identified two serious flaws, tracked as CVE-2026-109618 and CVE-2026-109619, which involve memory-management errors that could potentially allow attackers to execute unauthorised code. Their severity was rated CVSS 9.2, placing them in the critical category. Security researchers explained that successful exploitation could give attackers access to sensitive server information, databases and other resources. Because PHP processes web requests before individual applications execute their own code, the vulnerabilities could affect multiple services operating on the same vulnerable infrastructure.

One particularly concerning aspect of the incident is the role artificial intelligence played in identifying the vulnerabilities. Researchers from cybersecurity companies reportedly used advanced AI systems to analyse PHP’s source code, identify weaknesses and develop methods for demonstrating how the flaws could be exploited. Wiz reported using its Atlas AI research agent alongside Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol during its investigation. According to researchers, similar work could previously have required months of specialist analysis. The discovery highlights the growing importance of AI in cybersecurity, where the same technology can help defenders identify software weaknesses while potentially allowing malicious actors to develop attacks more quickly. Security experts have warned that attackers can also study publicly released patches to understand the vulnerabilities and target organisations that have not updated their systems.

The response has been significant, with organisations in several countries temporarily restricting access to online services. Government websites and other public-facing platforms in countries including the Netherlands, Finland, France and Germany were taken offline or placed under preventive maintenance while security updates were applied. Cloud infrastructure providers also reported increased attempts to exploit the vulnerabilities following their disclosure. Reuters reported that Cloudflare observed thousands of attempted attacks before the public announcement, while other technology companies reported a sharp increase in suspicious activity. However, precautionary website shutdowns should not automatically be interpreted as evidence that those organisations had been successfully breached. In several cases, authorities explained that the measures were taken to prevent potential attacks while their systems were being secured.

The PHP development team released security updates addressing the two critical vulnerabilities, urging organisations to upgrade immediately. The fixed versions include PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The European Union Agency for Cybersecurity and other European security organisations also advised businesses and government institutions to identify vulnerable systems, coordinate with hosting providers and prioritise internet-facing applications. Organisations unable to apply the updates immediately were advised to consider isolating vulnerable services from public networks until proper protection could be implemented. The incident has also raised questions about the security of software infrastructure maintained by relatively small development communities despite its widespread use across the internet. As AI-assisted vulnerability research becomes more powerful, the pressure on software developers and organisations to identify, disclose and repair security weaknesses is likely to increase.