# This Flaw Is So Serious Websites Should Consider Going Offline, NSA Says > Source: > Published: 2026-10-21 15:08:23+00:00 The IT industry is bracing for widespread cyberattacks due to a pair of severe flaws found in PHP, a scripting language widely used to operate millions of websites. The threat emerged on Tuesday after an anonymous user [warned](https://news.ycombinator.com/item?id=50167754) that two newly discovered vulnerabilities in PHP can be exploited to execute rogue code, enabling hackers to tamper with websites and servers that use the scripting language. "These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history," [says](https://www.wiz.io/blog/php2shell-php-rce) cybersecurity provider Wiz Security. "The vulnerable code had been present for more than a decade." The PHP Foundation, which maintains the language, has since confirmed that both flaws can lead to unauthenticated remote code execution. "All PHP users are strongly encouraged to update immediately,” the group said. Interestingly, an AI model from OpenAI helped uncover the flaw. More guidance for IT admins is available at [PHP2Shell](https://www.php2shell.com/). "The vulnerable code is in PHP itself. Websites can be affected even when their application code is secure," it warns. The PHP Foundation has [released](https://www.php.net/archive/2026.php#2026-10-21-5) patches, but only for PHP 8.2 and up. That’s a problem because the two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, also affect versions going back to PHP 5.4, [according](https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php) to the UK’s National Cyber Security Center (NCSC-UK). The fear is that hackers will quickly swoop in and develop exploits to attack the vulnerabilities before websites can roll out their own fixes. PHP works by “running on a web server to generate dynamic page content, interact with databases, and handle backend application logic before delivering the final HTML output to a user's browser,” the NCSC-UK noted. The US National Security Agency adds: "These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend[ed] that organizations take the system offline." CERT-EU, another cybersecurity group in Europe, echoed the recommendation, [posting](https://cert.europa.eu/publications/security-advisories/2026-018/): “Where immediate remediation is not feasible, organizations should consider isolating internet-facing applications from public networks until a fix can be applied.” PHP is estimated to power [nearly](https://w3techs.com/technologies/details/pl-php) 70% of websites where the scripting language can be identified. Another estimate [puts](https://trends.builtwith.com/framework/PHP) the number of sites using PHP at about 24 million. Wikipedia and WordPress are two major users; Wikipedia [says](https://wikis.world/@wikipedia/117479240950382392) it's "actively doing updates, so you may see some disruption," adding, "If you are running anything PHP, now would be a good time for you to also do updates." The good news is that the industry—including Google Cloud, Amazon's AWS, and Microsoft—has already been coordinating to patch the flaw. OpenAI also [revealed](https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/) that its model, GPT‑5.6 Sol, was used by cybersecurity firm [Calif](https://calif.io/php2shell/) to help uncover the threat. In addition, researchers at Wiz Security independently discovered and reported both vulnerabilities using AI models Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol during their research. (**UPDATE:** It actually looks like one security researcher [first](https://x.com/calif_io/status/2112914613297668583) discovered the issue back in early August.) Ironically, though, OpenAI and Wiz both warn that AI models can make it easy for hackers to exploit the flaw. The PHP Foundation also says there’s already a “[demonstrated](https://x.com/J4ck3LSyN/status/2112703096443097263) exploit where an unauthenticated request can trigger the attack before any application code runs." Cloudflare, a web infrastructure provider, has deployed new firewalls for customers, but CTO Dane Knecht [warned](https://x.com/dok2001/status/2112811965735202970): “We are seeing early attacks emerging and are updating mitigations as new vectors show up.” The National Cyber Security Center in the Netherlands [even](https://www.ncsc.nl/actueel) went as far as to pull its site offline as a precaution.  For companies on older versions, the PHP Foundation says: “Some distributions and LTS (long-term support) vendors provide backported fixes, so contact your vendor for details, or upgrade to a supported version.” However, the companies that discovered the flaw warn: "Upgrading PHP is the only complete remediation."