Most people have never heard of PHP, but the programming language is a key component of about 70% of websites whose server-side programming language is known — and two critical vulnerabilities have put unpatched systems at risk after technical details circulated prematurely on Tuesday.
The scope of the risk is staggering. According to VirusTotal, an online cybersecurity service that helps assess whether files, websites, domains, and IP addresses are associated with malware or other threats, 5.1 million IP addresses run PHP, including about 758,000 running end-of-life versions.
“These aren’t confirmed vulnerable systems, but the numbers highlight the potential scale of exposure, especially for older versions that may never receive official patches,” software security firm Echo wrote in a LinkedIn post.
The risk of hackers exploiting the vulnerabilities to take over websites is so high that the NSA recommends organizations using PHP take affected systems offline if an immediate update is not feasible, and Finland, the Netherlands and France have reportedly begun unplugging their government sites.
Patches for the two PHP vulnerabilities — CVE-2026-109618 and CVE-2026-109619 — were released Wednesday. Echo explained that the release had been scheduled for Oct. 22, but technical information appeared on the Hacker News website on Oct. 20. Screenshots began circulating online, and a video demonstrating how to exploit the vulnerabilities was posted but quickly taken down, it added.
“Two critical remote code execution flaws in PHP, both rated 9.2, are about as serious as it gets for the web,” Echo CEO and Co-Founder Eylam Milner told TechNewsWorld.
This is what happens when AI turns up a flaw that’s been hiding for years, he noted.
“Something nobody was worried about yesterday became an emergency overnight,” he said. “In this case, exploitation details were circulating before defenders had patches available, so attackers had a head start.”
“The PHP team has done a good job in a horrible situation,” he added. “The problem for most companies is they don’t know where they’re running PHP. It’s in base images and in components that bundle their own runtime, and a lot of it is on versions older than 8.2 that are past end of life.”
When Taking Websites Offline Is Warranted
Madelein van der Hout, a senior analyst at Forrester Research, a national technology research company headquartered in Cambridge, Mass., explained that what makes these vulnerabilities significant is where they sit.
“PHP underpins websites and applications across many organizations and their suppliers, so checking the corporate website alone is not enough,” she told TechNewsWorld. “Organizations need to establish where they are exposed and prioritize internet-facing systems.”
She supported disconnecting websites to address the problem. “Taking a website offline does not mean it has been hacked,” she said. “Where an organization cannot yet patch or adequately protect a potentially vulnerable system, temporarily taking it offline can be a proportionate risk decision — accept a short loss of availability rather than risk a potentially much more serious compromise.”
She also advised organizations that a critical vulnerability, an attempted attack and a successful compromise are three different things. “Organizations should respond urgently to potential exposure without treating every vulnerable or offline website as evidence of a breach,” she said. “That distinction matters, particularly while the situation is still developing.”
“This is a test of operational resilience, not just patch management,” she added. “Organizations have to decide whether they can keep services running safely while they respond — and who has the authority to take them offline if they cannot. A temporary shutdown can be the right decision, but it shows how a software vulnerability can become a business disruption even without a confirmed breach.”
Closing the Flaw, Checking for Intruders
The release of the PHP patches is an important step, but organizations should not mistake patching for proof that their systems are clean, noted Matt Hull, vice president of cyber intelligence and response at the NCC Group, a global cybersecurity consultancy.
“We are now seeing reports of exploit activity, which makes the window between these vulnerabilities becoming known and systems being patched particularly important,” he told TechNewsWorld. “There is a real possibility that vulnerable systems could already have been compromised, including the creation of backdoors.”
“The potential impact is serious,” he added. “Successful exploitation could provide remote shell access and potentially allow an attacker to move laterally into other parts of an organization’s environment. Those managing their own PHP systems, particularly internet-facing deployments, therefore need to understand not only whether they have patched, but whether there are signs that an attacker gained access before they did.”
Benny Lakunishok, co-founder and CEO of Zero Networks, an automated microsegmentation and zero-trust networking provider in Tel Aviv, Israel, explained that the PHP vulnerabilities could give attackers control of exposed servers without even needing a password.
“Over the next 48 hours, I expect a race between organizations deploying patches and attackers trying to exploit systems that remain vulnerable,” he told TechNewsWorld. “AI could make that race even faster by helping attackers develop and scale exploits.”
“The real danger isn’t just the initial compromise,” he added. “It’s what attackers can reach next: databases, credentials, internal applications and ultimately the rest of the enterprise.”
“No one has ever out-patched an attacker,” he continued. “We need to stop thinking about remediation as the entire answer and start thinking about compensation. Patch the vulnerability, but also deploy controls that prevent one compromised server from becoming a company-wide catastrophe.”
Shades of Heartbleed
Ramy Rahman, a senior principal solutions engineer at ArmorCode, a vulnerability management company in Palo Alto, Calif., compared the potential impact of the PHP vulnerabilities to Heartbleed, which affected an estimated 4.5 million people and cost more than US$500 million to mitigate.
“It’s too early to say whether the actual impact will compare,” he told TechNewsWorld. “What’s different today is that AI can help attackers move faster, giving defenders less time to patch.”
“AI makes it easier to examine large amounts of code and revisit flaws previously considered too difficult to exploit,” he said. “It also helps attackers reverse-engineer patches, shortening the window between a fix becoming public and an exploit becoming available.”
“Flaws we once thought were impractical to exploit are back on the table,” he continued. “The underlying risks aren’t new, but exploiting them is becoming easier and accessible to more people. We need to revisit old assumptions and get faster at patching.”
Shane Fry, chief technology officer at RunSafe Security, a software security company in McLean, Va., added that historically, turning a complex memory-safety bug into a reliable attack required significant expertise and time, repeated testing, and a detailed understanding of the vulnerable software. “AI is dramatically reducing that effort,” he told TechNewsWorld.
“We can no longer assume that a vulnerability is relatively safe simply because exploitation appears too difficult,” he said. “Organizations need to harden software at runtime so attackers cannot reliably turn memory corruption into control of a system.”
