Critical PHP flaws put 70pc of the web at risk of cyberattacks

Two critical security vulnerabilities in PHP, one of the most widely used programming languages for building websites, have raised concerns about the security of a large portion of the internet. 

The flaws could allow attackers to execute malicious commands on vulnerable servers remotely, potentially stealing sensitive data or installing malware without requiring a password.

With PHP powering a significant share of websites worldwide, the vulnerabilities could pose a widespread threat, particularly to systems that have not installed the latest security updates.

According to a report by TechCrunch, the two flaws, collectively referred to as “PHP2Shell,” were publicly disclosed on Wednesday and assigned the identifiers CVE-2026-109618 and CVE-2026-109619. The PHP Foundation has released security updates to address the vulnerabilities, but many servers may remain exposed until administrators apply the patches.

How the vulnerabilities work

PHP is an open-source programming language widely used to develop websites and web applications. It also underpins popular content management systems such as WordPress, Drupal and Joomla.

The two vulnerabilities were first identified in 2024, but researchers had not initially established an effective way to exploit them. Cybersecurity researchers have recently developed techniques to take advantage of the flaws, prompting the PHP Foundation to address the security risks.

The vulnerabilities are particularly concerning because an attack does not require a victim to click on a link or open a malicious file. If a server is running a vulnerable version of PHP without the necessary security fixes, an attacker may be able to execute commands remotely.

Known as remote code execution (RCE), this type of vulnerability can give attackers a pathway to install malicious software, steal sensitive information or establish persistent access to a compromised system.

AI-assisted research uncovers flaws

Security researchers at Calif, a cybersecurity firm, discovered the vulnerabilities while auditing PHP's source code. The work was conducted as part of the “Hack the Planet” initiative involving OpenAI and cybersecurity company Wiz.

OpenAI subsequently helped validate experimental techniques for exploiting the flaws.

The researchers said artificial intelligence played a role in the vulnerability research process. However, much of the work also depended on their existing expertise, familiarity with PHP's codebase and understanding of techniques used in previous cyberattacks.

The findings highlight the growing role of AI in cybersecurity research, including its potential to help identify and validate previously overlooked software vulnerabilities.

Signs of exploitation before patches

Amazon has reported indications that the vulnerabilities were being exploited before the security updates became available. The company observed signs of potentially related activity as early as October 17, although it remains unclear how the attackers obtained information about the flaws.

Separate reports from cybersecurity firms Palo Alto Networks and Trail of Bits indicated that, by Friday, researchers had found evidence of intrusions and subsequent malicious activity involving the vulnerabilities. The identities of the affected systems had not yet been established.

The reports raise concerns that attackers may already be targeting vulnerable servers while website operators work to deploy the necessary fixes.

What website operators should do

Security experts warn that smaller organisations and independent website operators could face heightened risks if they delay applying security updates. The potential exposure may extend beyond conventional web servers to development tools, network devices and security products that incorporate the affected components.

Website administrators are advised to:

●Install the latest PHP security updates applicable to their systems as soon as possible.
●Review server logs for suspicious activity, unexpected commands or signs of unauthorised access.
●Check for persistence mechanisms, including unfamiliar files, processes or accounts that could allow attackers to regain access.
●Assess related software and infrastructure for vulnerable PHP components.
●Apply additional protective measures where immediate patching is not possible, while prioritising a permanent fix.

Organisations that suspect a compromise should investigate the affected systems rather than assume that installing a patch alone will remove any malicious access already established.

The incident underscores the security challenges posed by widely deployed legacy software, as well as the increasing ability of researchers to use AI-assisted techniques to uncover vulnerabilities. With PHP embedded across a broad range of websites and applications, rapid patching and continuous security monitoring will be essential to reducing the risk of further attacks.