--- title: "Critical vulnerabilities discovered in PHP scripting language used by millions of websites worldwide" url: https://newscentral.site/critical-vulnerabilities-discovered-in-php-scripting-language-used/ language: en publisher: "News Central Site" section: "Technology" published: 2026-10-21T14:26:19.000Z updated: 2026-10-21T15:52:16.420Z id: 2ae9e9b8-676d-4a8c-b2c9-09029d491293 source: "Wired https://www.wired.com/story/this-is-not-a-drill-2-php-vulnerabilities-are-setting-the-internet-on-fire/" attribution: "Link to https://newscentral.site/critical-vulnerabilities-discovered-in-php-scripting-language-used/ and name News Central Site when you quote or summarize this story." --- # Critical vulnerabilities discovered in PHP scripting language used by millions of websites worldwide Two critical flaws have been identified in all PHP installations that serve web requests dating back to version 5 released in July 2004. Critical vulnerabilities have been discovered in the PHP scripting language, which is used by millions of websites worldwide. The two critical flaws, identified as CVE-2026-109618 and CVE-2026-109619, affect all PHP installations that serve web requests, dating back to version 5, released in July 2004. Despite being over a decade old, PHP versions 2 and newer are still supported and will receive patches to address the vulnerabilities. However, some legacy fixes may be produced by third-party vendors or specific PHP distributions, which could potentially lead to outdated systems persisting on the internet. This is a concern because foundational web layers like PHP can remain forgotten and un-updated in historic infrastructure. Security experts are warning of severe consequences if these vulnerabilities are overlooked, with one consultant stating "This is not a drill. The only safe solution is to update affected systems, as no complete mitigations have been identified. The widespread use of PHP in web development has left millions of systems vulnerable to potential attacks. According to security experts, this is a critical concern, as the programming language's flaws could have far-reaching consequences if exploited by malicious hackers. Security teams and developers are bracing for the worst-case scenario, fearing that attackers may quickly jump on the vulnerabilities before they can be fixed. This has already begun to play out, with internet infrastructure company Cloudflare reporting early attacks emerging even before the PHP Foundation detailed the vulnerabilities and released fixes. The sheer scale of potential damage is daunting, given that most websites run on PHP. Security consultant Davi Ottenheimer likened the bug in a file upload interface to an unlocked front door, accessible without needing specific knowledge of the site or software it runs on. With fixes only recently released, security firm Sansec warned that mass attacks could start within 15 minutes. This raises concerns about the speed and effectiveness of mitigation efforts, as well as the potential for widespread disruption if these vulnerabilities are exploited. As the updated versions of PHP become available, some organizations have chosen to take their websites offline as a precautionary measure to prevent potential exploitation of critical vulnerabilities. Several high-profile sites were inaccessible due to this proactive approach, including multiple Finnish government websites and the National Land Survey. The Port of Rotterdam's website was also temporarily taken offline. These measures reflect the severity of the situation and highlight the need for swift action. Security experts are urging organizations to patch their systems immediately, warning that exploitation could occur rapidly and on a large scale. According to one expert, AI has made it easier for attackers to identify and exploit vulnerabilities like these, making prompt mitigation essential. The discovery of these vulnerabilities is attributed to a combination of efforts from security companies Wiz, OpenAI, and Calif, who claim to have independently identified the issues using various tools, including AI-powered ones. The researchers warn that affected servers are vulnerable to unauthenticated attacks, allowing attackers to execute code or access sensitive process memory. The vulnerabilities have been assigned a severity score of 2 out of 10 on the Common Vulnerability Scoring System (CVSS), indicating a moderate level of risk. Despite this relatively low rating, the PHP Foundation has issued a warning that it reserves the right to release details about the vulnerabilities earlier than planned if they become public or are exploited in the wild. This early warning may have given some developers and security teams a chance to prepare for updates ahead of time. Reports suggest that some information about the vulnerabilities may have leaked prematurely, which could be attributed to the PHP Foundation's decision to issue an early warning. In response to the potential threat, several cybersecurity agencies around the world have issued warnings urging IT teams to update their systems as soon as possible, with the possibility of websites being taken offline temporarily while fixes are applied. The EU's Computer Emergency Response Team (EU-CERT) and Australia's cybersecurity agency have both advised IT teams to be prepared for updates, while the UK's National Cyber Security Center (NCSC) has urged organizations to prepare for immediate updating of systems" using PHP. Organizations that cannot immediately update their systems should consider taking them offline until a full mitigation can be implemented. This is according to an agency's online guidance, which emphasizes the importance of prompt action in the face of critical vulnerabilities. The agency advises organizations to identify and locate all systems running PHP across their infrastructure, with particular attention paid to those connected to the internet. Regular monitoring for potential exploitation should also be conducted on these systems. --- Source: [Wired](https://www.wired.com/story/this-is-not-a-drill-2-php-vulnerabilities-are-setting-the-internet-on-fire/) Published by News Central Site: https://newscentral.site/critical-vulnerabilities-discovered-in-php-scripting-language-used/