Published Oct 22, 2026 | 12:34 PM ⚊ Updated Oct 22, 2026 | 1:14 PM
Among the websites that prioritised precaution over staying online were the BBC, Wikipedia, the Internet Archive and Finland's government websites.
It was flashing Code Red for millions of websites on the internet after the PHP Foundation released patches on October 21 for two serious vulnerabilities that, if left unaddressed, could cause ‘dire consequences’.
The PHP Foundation said that the “vulnerabilities, under the right conditions, allow an unauthenticated attacker to execute code on servers running PHP”.
About 70% of the internet was potentially left at risk, it was reported. Shahak Shalev of Malwarebytes termed the vulnerabilities “a goldmine for hackers”.
Among the websites that prioritised precaution over staying online were the BBC, Wikipedia, the Internet Archive and Finland’s government websites.
Japan’s Prime Minister Sanae Takaichi was concerned enough to ask the public whether their websites ran on PHP.
“We have an urgent request for everyone to take action tonight,” Takaichi posted on X.
“If it is difficult to apply the fix patch promptly, temporarily suspending websites and similar measures can be considered an effective way to reduce risk,” she added.
The US National Security Agency (NSA) was also worried.
“These vulnerabilities often provide a direct path to the server’s file system or database,” the NSA wrote.
“If an immediate update is not feasible, it is recommended that organisations take the system offline until it can be fully mitigated,” it added, echoing Takaichi’s warning.
Authorities in Belgium, the Netherlands, Finland, the Czech Republic, France and Germany shut down websites to apply the security patches.
It was to be a hard day’s night for many.
The bugs weren’t new. It was improved detection with the help of AI, particularly in the case of the first vulnerability, that led to their discovery.
The first vulnerability had been reported by the security firm Calif on August 11. OpenAI claimed Calif had identified the “critical flaw” with the help of GPT-5.6 Sol.
Cybersecurity firm Wiz, owned by Google’s parent company Alphabet, had reported the second vulnerability on August 24. Wiz termed it “among the most severe vulnerabilities discovered in PHP, and arguably in software history”.
“The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit,” Wiz added.
The PHP Foundation released patches for the two vulnerabilities (CVE-2026-109618 and CVE-2026-109619, collectively associated with PHP2Shell) on October 21, almost two months after the first flaw was reported. The updates covered PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
The foundation acknowledged the enormity of the threat, warning that AI would help find “bugs faster than ever, for defenders and attackers alike, and the number of reports will keep growing”.
AI was powering a “race to exploit” such vulnerabilities, agreed Costin Raiu, co-founder of the cybersecurity research and incident response firm TLP:Black.
Chris Holland, an expert programmer who has worked on multiple platforms for over 20 years, told those making fun of PHP’s travails that nobody is future-proofed.
“LLM-driven vulnerability research and breaching frameworks are about to humble the absolute heck out of all of us. They already have. If you think your stack is not at risk, think again,” he warned.
Professor Alan Woodward, a cybersecurity expert at the University of Surrey, had a different warning to share.
He told the Guardian that “the troubling part is there is going to be a long tail of websites that may not be maintained as well, and they are going to remain vulnerable, which means we may see weeks and months of ongoing attacks. For the big juicy targets, I hope to goodness they are being patched quickly.”
PHP, which initially stood for Personal Home Page, was developed by Danish-Canadian programmer Rasmus Lerdorf using C-based CGI scripts in 1993 and released to the world in 1995.
Two Israeli software developers, Zeev Suraski and Andi Gutmans, then took over. As students at Technion – Israel Institute of Technology, they rewrote and released PHP 3, renamed as Hypertext Preprocessor, with basic object-oriented programming (OOP) built in. PHP 4, the next iteration, saw the arrival of Zend Engine, an open-source scripting engine, in 2000.
It was a transformational moment, and from powering just 1.5 million domains before, PHP went on to become the preferred programming language for over 20 million domains in a few years. Zend borrows its name from the first two letters of Zeev Suraski’s name and the second and third letters of Andi Gutmans’ name.
Facebook was originally built in 2004 on PHP 4. Wikipedia, now the go-to encyclopedia online, also began on the PHP 4 platform. As did WordPress.
A group of core developers funded by the PHP Foundation currently maintains the programming language.
PHP is estimated to power more than seven in 10 websites that are currently online, with WordPress powering 43% of these sites. Its mascot is a blue elePHPant designed by Frenchman Vincent Pontier.
Also Read:
Explained: What is the eMudhra digital certificate fiasco and how can you protect yourself
Netflix’s biggest layoffs ever: Is shareholder value to blame?
(Compiled by R Rajesh Kumar.)
