Two critical vulnerabilities in PHP, the programming language powering approximately 70% of the world’s websites, have triggered emergency patching and precautionary shutdowns. Rated 9.2 out of 10 for severity, the flaws could enable remote code execution, allowing attackers to issue malicious commands, potentially compromise servers or access sensitive information. PHP’s maintainers released emergency fixes on 21 October. The vulnerabilities affect servers hosting websites, rather than visitors’ personal devices.
Calif discovered one vulnerability using OpenAI’s GPT-5.6 Sol during an OpenAI-funded audit, while Wiz independently identified and reported both. Collectively known as PHP2Shell, the flaws involve PHP’s handling of memory after errors. Wiz demonstrated attacks against WordPress and Drupal without needing to log in. Its researchers first found a flaw on 19 August and reported the bugs to PHP’s security team on 24 August. Coordinating repairs took roughly two months, with hosting providers and security companies preparing protections before disclosure. However, details emerged ahead of the planned announcement, accelerating the response. Attempted exploitation has been detected, including activity that Amazon Threat Intelligence observed before public disclosure.
Authorities urged organisations to install updates immediately or disconnect affected systems until secured. Government websites in France, Germany, the Netherlands and Finland were temporarily withdrawn; German officials described their action as precautionary and reported no identified security incidents. The Wikimedia Foundation also suspended supporting services during patching. Cloudflare introduced protective filtering, but such measures cannot remove the underlying vulnerabilities. Operators using managed hosting or Linux distributions should consult their providers, since fixes may be incorporated without changing the displayed PHP version number.
