A critical security flaw in PHP, one of the internet’s most widely used programming languages, has triggered an international cybersecurity response, with website operators scrambling to protect their systems against potential hacking attacks.
The vulnerabilities, disclosed on Wednesday, 21st October, could allow hackers to take control of vulnerable web servers without needing a password or an existing user account.
Security researchers have demonstrated attacks capable of executing malicious code and accessing sensitive information held in server memory.
The potential consequences include stolen data, compromised websites and unauthorised access to systems behind them.
PHP used by 70% of websites
PHP operates behind the scenes, powering dynamic websites and applications. It is used extensively by WordPress, Drupal and Joomla, alongside countless business websites, online shops, blogs and public-sector services.
Estimates suggest that PHP is used by around 70% of websites for which the underlying programming language can be identified, making the discovery particularly serious.
Two critical vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have been assigned severity scores of 9.2 out of 10.
Vulnerability
Researchers found that weaknesses in PHP’s handling of memory could potentially enable remote code execution or expose passwords etc.
The immediate impact has already been felt. Government websites and other online services in Europe and elsewhere were temporarily taken offline. Administrators worked to assess their exposure and install security fixes.
Cybersecurity agencies, including Britain’s National Cyber Security Centre, urged organisations to identify vulnerable systems and update them urgently. Where immediate protection was not possible, taking affected systems offline was advised.
Check
PHP developers released emergency updates covering supported versions, but the problem is complicated by older installations. Some no longer receive security support.
Website owners may also rely on hosting companies or third-party software providers to manage the underlying technology.
The discovery has raised another important concern: artificial intelligence is changing the cybersecurity landscape.
Researchers used advanced AI tools to help identify and investigate the vulnerabilities, demonstrating how technology can uncover weaknesses that have remained hidden for years.
However, similar capabilities could help malicious actors develop exploits more quickly. The immediate priority is to patch vulnerable systems before attackers can exploit them at scale.
Although the disclosure does not mean that every PHP-powered website has been hacked, the breadth of the software’s use makes the potential exposure significant.
The incident is a reminder that the internet’s apparent resilience depends on countless interconnected systems being maintained and secured.
A flaw deep inside widely used software can rapidly become a global problem.