Critical vulnerabilities in the PHP web scripting language could allow hackers to take control of any website running the widely used software, PHP’s developers said on Wednesday, as they released emergency updates that sent website owners scrambling to fix the flaws.

“All PHP users are strongly encouraged to update immediately,” the developers said in a security advisory about the new versions, which fix vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. Both vulnerabilities could allow hackers to execute malicious code on and potentially take control of websites developed using the popular open-source scripting language.

Security experts said the vulnerabilities could have far-reaching consequences. Roughly 70% of websites in the world use PHP to power their platforms.

“These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history,” researchers at Google-owned security firm Wiz, one of the companies that discovered the flaws, wrote in a blog post.

Because of variations in how websites are set up, not every website that uses PHP is vulnerable to exploitation, but one researcher estimated that more than 1.3 million websites were. Security firm Palo Alto Networks produced a much larger estimate: more than 22.6 million exposed instances.

“There are already reports of exploits in the wild,” security researcher Nicholas Weaver told Cybersecurity Dive, “which means systems which aren't up to date are incredibly vulnerable.”

Many organizations will not be able to patch the vulnerabilities because they are running old versions of PHP that are not receiving the security updates. Security firm Cisco estimated that roughly half of internet-facing instances were too old for the fixes.

Global government warnings

Government cybersecurity agencies around the world, including the Cybersecurity and Infrastructure Security Agency (CISA) and its counterparts in the U.K., Canada, Australia and the European Union, urged website operators to take their sites offline until their PHP versions could be updated. Some organizations, including the government of Finland and the Dutch House of Representatives, disconnected their sites from the internet on Wednesday.

The newly disclosed vulnerabilities involve PHP’s response to errors processing HTTP requests. If PHP runs out of memory because an HTTP request is too large, the software will fail to release its hold on the memory it tried to use for the task, putting it in a vulnerable state.

“By manipulating the data PHP encounters in this invalid memory, an attacker may be able to crash a PHP process, expose sensitive information, or execute code provided by the attacker,” the internet infrastructure firm Cloudflare said in a blog post. (Cloudflare said it had applied firewall rules that would protect customers from hackers’ attempts to exploit the vulnerabilities.)

The National Security Agency urged its partners to update their websites as soon as possible. “These vulnerabilities often provide a direct path to the server's file system or database,” the agency said on social media.

The Trump administration said federal agencies were assessing their use of PHP and working with critical infrastucture operators to help them apply the patches.

“The Administration is tracking and coordinating with federal agencies and leading [AI] labs to expedite the release of the fix and protect American networks and critical infrastructure,” the White House said in a statement.

The U.S. government learned about the vulnerabilities on Oct. 16, the White House said.

New AI era

In addition to Wiz, the other security firm to discover the vulnerabilities was Calif, which found them using OpenAI’s GPT-5.6 Sol model.

“Given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory,” OpenAI said in a statement. “It highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits.”

OpenAI said it coordinated the patching process with U.S. and foreign government agencies, including the Cybersecurity and Infrastructure Security Agency and the White House’s Office of the National Cyber Director.

Threat intelligence experts at watchTowr and Sophos said they were already seeing discussion and attempted exploitation of the vulnerabilities in cybercriminal communities.

“Whilst nobody has been successful to date,” said Jake Knott, watchTowr’s head of threat intelligence, “we don't expect that will last long.” 

Weaver, the security researcher, said the PHP vulnerabilities represented one of the first widespread vulnerability crises of the AI era.

“One thing AI systems are really good at is turning a patch into an exploit, since a patch is a recipe for ‘what has changed,’” he said. “We are in the world where you have to apply updates effectively instantly.”