Two severe vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, enable unauthenticated remote code execution across versions dating back to PHP 5.4.
Researchers discovered the flaws using AI models, and patches have been released for PHP 8.2 and up.
According to cybersecurity firm Wiz Security, the problematic piece of code has been in the language for more than a decade and is one of the most serious issues ever identified in software history. The US National Security Agency (NSA) has suggested that organizations take their systems offline if an immediate update is not possible, while the European Union's CERT-EU has recommended isolating applications that face the internet.
The problem affects a very large percentage of the internet, as PHP is estimated to run on about 24 million websites, or almost 70% of all known websites. Users include Wikipedia and WordPress. Wikipedia announced that it was proceeding with immediate updates, warning that there may be temporary interruptions in its operation. Accordingly, the National Cybersecurity Center of the Netherlands took its website offline as a precaution.
The PHP Foundation, which maintains the language, confirmed the flaws and released patches for PHP versions 8.2 and above. However, the UK's cybersecurity authority (NCSC-UK) noted that the vulnerabilities affect versions going back as far as PHP 5.4. Although some vendors are offering separate patches for older systems, the researchers who discovered the problem warn that upgrading PHP is the only permanent solution.
Artificial intelligence models also helped discover the vulnerabilities. OpenAI revealed that its GPT-5.6 Sol model was used by cybersecurity firm Calif to help identify the threat, while Wiz Security researchers independently discovered the vulnerabilities using the Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol models.
READ ALSO
CISA orders immediate fix for serious Plex Media Server security flaws
However, the PHP Foundation accused Calif of accidentally leaking a video showing how the attack was carried out, a day before the public warning. Both the technology companies and the PHP Foundation warned that artificial intelligence could make it easier for those who want to exploit the problem.
At the same time, Cloudflare said it has installed new protection systems for its customers as the first real attack attempts are observed.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source