Critical PHP flaws prompt shutdowns and urgent patching warnings

Government agencies, councils and private services in multiple countries have temporarily taken websites or systems offline as a precaution against two critical flaws in PHP, a widely used web programming language. The PHP Foundation said the two vulnerabilities affect all PHP installations serving web requests going back to PHP version 5. AWS Security warned that vulnerable, unpatched systems could let unauthenticated attackers execute arbitrary code, access process data or take control of servers.

In Scotland, at least seven of 32 councils and six of 14 health boards took their websites offline. The wider disruption extended beyond government sites to media services and other online systems.

The US National Security Agency, the UK's National Cyber Security Centre and CERT-EU advised prompt patching, or temporary isolation or shutdown where immediate remediation was not feasible.

The NCSC also advises organisations and businesses to identify systems running PHP across their technology infrastructure, focus particular attention on systems using PHP that are connected to the internet, and monitor internet-connected systems using PHP for potential exploitation.

PHP maintainers released emergency fixes for CVE-2026-109618 and CVE-2026-109619, which the PHP Foundation said concern memory-management and error-handling behaviour. Wiz warned that a successful exploit could expose passwords, authentication tokens, API keys, certificates and user data, as well as permit malware deployment or website modification.

Cloudflare reported early attacks after disclosure, while watchTowr reported signs of in-the-wild exploitation. Amazon security chief CJ Moses said his team detected an attempt to exploit the vulnerabilities against a honeypot system on 17 October.

Amazon’s report describes further attempts against its honeypot network before disclosure, but says technical analysis was ongoing and it was unclear whether any of those attempts would have succeeded on real-world systems.

OpenAI described the incident as one of the most consequential security problems in recent memory, citing PHP's widespread use and the potential for unauthenticated remote code execution. Sansec warned that attackers could rapidly launch mass exploitation campaigns: public fixes can be reverse engineered, and AI can accelerate the adaptation of exploits to different environments.

Commentator Elias Taylor argued that the flaws are serious but should not be treated as a Log4Shell-scale event. He said circulating proof-of-concept exploits did not work against ordinary, unmodified PHP installations; many required an additional weakness known as local-file inclusion. No working general exploit had emerged, he said.

The PHP Foundation says the memory-exhaustion flaw allowed attackers without a login to run code on Apache servers with default PHP settings, before any website code ran. The maintainers say exploit reliability depends on the PHP build, extensions and server setup. For the second flaw, their advisory says separate requests must reach the same server process, with one leaving stale data that the other uses.

An accelerated disclosure

The PHP Foundation said the disclosure timetable was accelerated after vulnerability information and proof-of-concept material began circulating ahead of the planned coordinated release. The coalition working on disclosure had intended to publish the details on 22 October.

PHP developers accused Chainguard of breaking the embargo by publishing built images containing fixes early, The Register reported. Chief executive Dan Lorenc denied that the company had leaked the vulnerability. He defended the early publication, citing reports that people were already being hit and saying Chainguard changes its disclosure policy when there is evidence of active exploitation.

The PHP Foundation and security researchers said AI-assisted research helped find the vulnerabilities. Wiz said AI was instrumental in making exploitation research practical: the chain of steps was exceptionally complex and had been prohibitively difficult for human researchers.

The PHP Foundation says AI is producing more reports without removing the need for experienced maintainers. Tools cannot resolve difficult engineering trade-offs over compatibility, performance and patch review, it argues, and there are too few engineers to make those decisions. It expects report volumes to keep growing as tools find bugs faster for both defenders and attackers.

The patching challenge

John Hammond said identifying every exposed PHP deployment complicates remediation and can extend outages, particularly for organisations with legacy, bundled or volunteer-managed systems. An analysis in the Irish Independent highlighted the greater exposure smaller organisations and operators of unmaintained sites may face when they lack technical resources or continue using unsupported PHP versions.

The PHP Foundation says there are no complete mitigations, while AWS Security describes immediate upgrading to a patched release as the only complete fix. Supported fixed releases are PHP 8.5 ($0.13 / £0.1).12, 8.4.27, 8.3.36 and 8.2.35.

For operators still running PHP 5.4 ($0.09 / £0.06) through 8.1, AWS Security said there is no upstream fix: obtaining a complete upstream repair requires migration to a supported branch.