Two serious security flaws in PHP, a programming language used by about 70% of the world's websites, prompted emergency updates on October 21, 2026. Both received danger ratings of 9.2 out of 10. Attackers could use the weaknesses to access private information or take control of servers, the computers that host websites. The flaws affect these servers rather than users' personal devices.
Researchers used AI to help uncover the problems. Calif identified one with OpenAI's GPT-5.6 Sol, while security company Wiz independently discovered both. Information about the weaknesses became public before the planned announcement, increasing pressure to secure affected systems. Security companies have detected attempted attacks, although evidence of widespread exploitation was initially limited.
Governments in France, Germany and Canada temporarily took some websites offline as a precaution. The Wikimedia Foundation, which operates Wikipedia, also stopped some supporting services while installing updates. Authorities urged website operators to apply fixes immediately or consider taking affected systems offline until they could be secured. Security companies introduced filters to block attempted attacks, but these protections do not repair the underlying software. Operators still need to install the PHP fixes, checking with their hosting providers when necessary.
