Two holes just opened up in one of the most heavily used pieces of software on the planet, and for a few tense days this week, nobody outside a small circle of engineers knew how bad it was going to get. The vulnerabilities, tracked under the Common Vulnerabilities and Exposures (CVE) identifiers CVE-2026-109618 and CVE-2026-109619, sit inside the core engine of PHP, the programming language that quietly renders a huge share of the pages people load every single day. Both have been rated 9.2 out of a possible 10 on the Common Vulnerability Scoring System (CVSS) version 4.0, the industry's standard yardstick for severity, putting them firmly in the critical category reserved for bugs that let an attacker break in without so much as a stolen password. To understand why this matters, it helps to understand what PHP actually does. Every time somebody loads a web page, something has to fetch the right information, often from a database, and stitch it into a page a browser can display. For a huge chunk of the internet, that something is PHP, a free, open-source language that has been doing this unglamorous but essential job since the late 1990s. It is not owned by a single company, which is part of why it spread so widely through government sites, universities and small businesses that did not want to be locked into one vendor, but also why fixing a flaw this deep requires coordinating an entire ecosystem rather than one corporate patch Tuesday. The technical root of the problem lies in how PHP behaves when it runs out of memory mid-request. Security researchers at the network discovery firm runZero explained that one of the bugs, CVE-2026-109618, exists because PHP handles out-of-memory errors by exiting the current process with a function called longjmp, which can interrupt the software while request data is only partially loaded. That half-finished data can then be misread during cleanup, allowing an unauthenticated attacker sitting anywhere on the internet to execute their own code on the server, and crafted web requests can trigger the flaw before a website's own code even gets a chance to run, on servers using the common Apache mod_php setup. The second bug, CVE-2026-109619, involves what researchers call stale global state, essentially leftover memory that should have been cleared but wasn't, opening a second route to the same outcome. The cybersecurity team at Tenable confirmed both are remote code execution flaws, and that the earliest vulnerable code path identified by the security firm Calif traces all the way back to PHP version 5.4, a branch first released in 2012. The scale of exposure is what turned this from a technical curiosity into an emergency. Researchers at Wiz, one of the firms that uncovered the flaws, described PHP as a general-purpose scripting language that powers 70% of all websites in the world, and warned that every PHP version released in the last decade carries at least one of the two bugs. That includes the software underneath WordPress, Joomla, Drupal and Wikipedia's MediaWiki platform, among many others, and Wikipedia itself temporarily took several systems offline as a precaution, leaving users briefly unable to reach parts of the site. WordPress by itself accounts for roughly two in five of all websites tracked in the W3Techs usage survey, meaning a staggering slice of small business sites, blogs, news outlets and online shops all sit somewhere on the affected family tree. Not every one of those sites will get rescued, either. An analysis by the exposure-tracking firm mallory.ai found about 884,000 internet-facing hosts running PHP versions so old that they are officially end of life, versions 8.1 and earlier, that will receive no official fix. PHP did publish limited backported patches reaching as far as version 7.4, but anything older than that is simply out of luck unless the site owner upgrades, isolates the server behind a firewall, or takes it offline. Stripped of the jargon, the risk looks less like a single dramatic hack and more like a landlord discovering a structural crack in a load-bearing wall shared by half the buildings in the city. Thai Duong, chief of the security firm Calif, which helped uncover the bugs, put it bluntly: "The reality is that there's very little the average internet user can do." He added that people should be concerned but not panicked, because "the responsibility lies with website operators, hosting providers, and the broader security community" rather than with whoever happens to be browsing a news site or an online shop that day. Attackers did not wait politely for the official disclosure date. Amazon's threat intelligence team said it detected an exploitation attempt against its MadPot sensor network dating back to October 17, four days before the public disclosure, originating from an address tied to a commercial anonymisation service. Once the patch and technical details became public on October 21, the activity exploded. Amazon reported that proof-of-concept exploits appeared within hours of the embargo lifting and were almost immediately turned against its own sensors, with the company concluding that the bugs are now being broadly exploited in the wild. The attack surface management firm watchTowr said its head of threat intelligence, Jake Knott, had seen attackers probing but not yet succeeding, warning that was unlikely to last. Separately, the security firm Hadrian reported seeing attacks at scale that abuse a specific PHP feature tied to file uploads, and the WordPress-focused firm Patchstack flagged a live campaign in which attackers with stolen dashboard keys for the backup plugin UpdraftCentral were already installing backdoors on connected WordPress sites, urging administrators to revoke those keys immediately. The disclosure itself was messier than planned. A coordinated release had originally been pencilled in for October 22, but after the CVE identifiers and even a demonstration video leaked online on October 20, the PHP security team moved the patch forward by a day, publishing fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 at 14:00 UTC on October 21. Researchers at Wiz noted that the underlying flaws were first confirmed as exploitable against Drupal in August and against WordPress the following day, with PHP's own team acknowledging the issue in September before spending weeks quietly building a fix that touched the core interpreter itself rather than a single plugin or module, a process that explains why even a well-resourced, decades-old project needed roughly two months to ship a safe release. Hosting providers moved with unusual speed once the patch landed. GoDaddy told customers it had patched every PHP version on its managed WordPress hosting product by 19:30 UTC on release day, meaning those customers needed to do nothing, while warning that anyone running WordPress, WooCommerce, Drupal, Joomla, Magento or Laravel elsewhere should simply assume they were exposed until proven otherwise. Smaller hosts such as InMotion Hosting said they had already disabled the specific PHP setting tied to the exploit across their servers as a stopgap, even before an official patch existed. For the long tail of small business owners and hobbyists running ancient, end-of-life PHP installs that will never be patched, specialist firms such as TuxCare began offering paid extended support patches, a reminder that keeping very old software alive now increasingly means paying someone to do it. For most ordinary website visitors, there is no specific action to take beyond normal online hygiene, since the fix is a server-side job for whoever runs the site. Small business owners who manage their own hosting, however, are being told plainly to check their PHP version with their hosting provider immediately and update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 without waiting for a routine maintenance window.
💻 technology
Two PHP Bugs Put 70% of the Internet at Risk
Hackers are already probing a pair of critical flaws buried deep in PHP, the ageing code that quietly runs the back end of most of the websites on earth. Patches exist, but hundreds of thousands of servers running outdated versions will never get one.
My Take
The uncomfortable truth buried in this story is not that PHP is bad software, it is that the internet has spent thirty years quietly building itself on top of a handful of ageing, under-resourced open-source projects and crossing its fingers. PHP runs a majority of the web not because it is the best possible choice in 2026, but because migrating off it is expensive, disruptive and easy to postpone indefinitely, right up until the week two critical holes surface in the core engine simultaneously. Hundreds of thousands of servers are now permanently exposed simply because somebody never got around to an upgrade, and no patch is coming to save them. There is also something genuinely new here worth sitting with: these flaws were surfaced using AI research tools working alongside human security teams, in a process that moved from first discovery to confirmed exploitation against Drupal and WordPress within weeks. That is a double-edged sword. The same acceleration that helped defenders find and responsibly disclose a decade-old bug is available to attackers too, and the speed at which proof-of-concept exploits appeared within hours of the patch landing is a preview of a much faster, much less forgiving disclosure cycle to come. For ordinary people scrolling the news or buying something online, there is genuinely very little to do beyond the basics of good password hygiene and keeping an eye on any unusual activity on accounts tied to affected sites. The real responsibility, and the real failure if things go wrong, sits with hosting companies and website operators who have let critical infrastructure quietly age past its expiry date. This will not be the last time a building block nobody thinks about turns out to be the whole foundation.
What Happens Next
Expect a genuine wave of attacks over the coming weeks as the technical details of both bugs circulate more widely and automated scanning tools get updated to probe for unpatched servers. Security firms including watchTowr and Hadrian have already said publicly they expect successful large-scale compromises, not just probing, once attackers refine working exploits against real-world configurations rather than test environments. Hosting providers that have not yet finished rolling out patches, including some shared and Windows hosting platforms still waiting on vendor-supplied packages, are the most likely source of the next headline-grabbing breach. The longer-term story is about the roughly 884,000 servers running end-of-life PHP versions that will never receive an official fix. Some of those site owners will quietly upgrade now that they have been forced to look at their infrastructure for the first time in years. Many will not, either because they do not know the risk exists, cannot afford a migration, or are running software built on top of PHP that has not itself been updated to support newer versions. Specialist firms offering paid extended security support for abandoned software branches are likely to see a surge in business, effectively monetising the gap left by an open-source project that cannot support every version forever. Watch also for scrutiny of the disclosure process itself. The leak of CVE identifiers and a demonstration video ahead of the planned release date forced PHP's security team to ship a day early, a reminder that coordinated disclosure only works as long as embargoes hold, and Amazon's own threat intelligence team has already noted that attackers were testing exploits four days before the public announcement. Expect renewed debate among security researchers about whether embargo windows for infrastructure this widely used are still fit for purpose in an era where AI tools can accelerate both discovery and exploitation.
What History Tells Us
Security researchers have drawn direct comparisons between one half of this vulnerability pair and Heartbleed, the 2014 flaw in the OpenSSL encryption library that exposed passwords, session cookies and private keys across a huge swathe of the secure web and became one of the defining cybersecurity events of the decade. Wiz researchers went further, describing these new PHP flaws as ranking among the most severe ever found in the language, and arguably in software history, a claim that reflects both the CVSS 9.2 severity score and the sheer scale of a code base that underpins so much of the public internet.