PHP is a computer language. It gives computers instructions and helps run about 70% of the world's websites. Researchers found two serious safety problems in it. Both scored 9.2 out of 10 for danger. The problems could let attackers steal private information or take control of computers that run websites. They affect those computers, not people's own phones or computers.
AI helped researchers find the problems. A team called Calif used OpenAI's GPT-5.6 Sol to find one. A company called Wiz found both problems on its own. PHP's developers released fixes on October 21, 2026. Information about the problems became public before the planned date. Security teams have seen attempts to use the problems to attack websites.
Governments in France, Germany and Canada took some websites offline for safety. The group behind Wikipedia also stopped some supporting services during updates. Website teams need to install the fixes as soon as possible. Security companies added tools to block attacks, but these tools do not fix PHP itself. Website teams still need to update their systems.
