Critical PHP Vulnerabilities Threaten Over 70% of the Internet

Two severe security flaws, dubbed PHP2Shell, have been discovered in the PHP programming language, which powers an estimated 70% to 75% of the world's websites. These vulnerabilities allow remote code execution and server takeover without requiring passwords or administrative privileges, earning them a critical CVSS score of 9.2. The flaws were identified with the help of artificial intelligence and were publicly disclosed on October 26, 2026. Global cybersecurity agencies are warning of widespread attacks, prompting governments and major organizations to take servers offline as a precautionary measure. The Israeli National Cyber Directorate has also urged immediate updates to PHP environments.

PHP, a widely used open-source language since the early 1990s, is the backbone for popular content management systems like WordPress, Drupal, and Joomla. Tiffany Paris, Interim Executive Director of the Drupal Association, stated that "all servers using any version of PHP released in the last 20 years will be vulnerable," affecting the majority of the internet. Official security patches were released on October 21, 2026, with the PHP Foundation issuing an urgent call for immediate updates.

Intelligence and cybersecurity agencies worldwide have issued strong warnings. The NSA's Cyber Division advised organizations to prepare for immediate updates, suggesting taking systems offline if an immediate patch is not possible. The UK's National Cyber Security Centre and the FBI have echoed similar recommendations, urging immediate action to prevent malicious actors from accessing sensitive data and networks. The FBI specifically advised isolating systems, preserving logs, and reporting any breaches.

The vulnerabilities, which have existed in PHP's code for over a decade, relate to how the language handles error conditions and memory crashes. They were discovered in August by the Calif group using an AI language model and independently by the Israeli company Wiz using their research tools. Wiz highlighted that AI has significantly lowered the barrier to exploiting these complex flaws, which were previously difficult to leverage manually. OpenAI acknowledged leading a coalition to prepare fixes, calling the bug a significant memory security issue and a milestone for AI in cybersecurity.

Early signs of exploitation have been reported by Cloudflare and Amazon, with researchers from Palo Alto Networks identifying over 22.6 million potentially vulnerable instances online. The discovery of these flaws by multiple researchers almost simultaneously is attributed to advancements in AI models. Organizations are strongly advised to update their PHP servers or disconnect them from the internet until updates can be applied. The widespread nature of these vulnerabilities has led to proactive shutdowns of government services, websites, and platforms in countries like the Netherlands, Finland, France, and Denmark, as well as by organizations like Wikipedia and the Internet Archive.

According to Censys data, approximately 1.5 million out of 2.6 million PHP hosts are running unsupported versions (8.1 and older) for which no official patch exists. While major platforms like WordPress and Tumblr are reportedly protected, and Israeli services like Wix are unaffected as they don't use PHP, smaller websites and shared hosting environments are at high risk. Security experts warn of long-term consequences, including secondary breaches, phishing attacks, malware distribution, and third-party risks, emphasizing the need for multiple layers of defense.