Berk Kutay Gokmen
21 October 2026•Update: 21 October 2026
Developers of the widely used PHP programming language urged users to install security updates immediately on Wednesday after two critical vulnerabilities were found that could allow remote code execution, raising concerns about the security of websites and servers worldwide.
The developers released patched versions of the program and warned that attackers could exploit the flaws without authentication.
In a security advisory, the PHP team said all installations handling web requests were potentially at risk.
The developers identified the vulnerabilities as CVE-2026-109618 and CVE-2026-109619. The flaws involve memory-handling errors and outdated internal state that can persist between requests, potentially allowing attackers to execute malicious code on affected servers.
The US National Security Agency (NSA) also asked organizations using PHP to prepare for an immediate update, warning that the vulnerabilities could provide attackers with direct access to server file systems or databases.
“These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated,” according to the agency, adding that more detailed guidance would follow.
The FBI Cyber Division urged organizations to immediately update affected PHP installations and inventory systems running PHP, prioritizing internet-facing servers and third-party products that include the programming language
The bureau also called for monitoring web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files, to help identify potential exploitation.
OpenAI said in a statement that its models helped researchers discover the flaws through its Patch the Planet initiative, which brought together software maintainers, researchers and security providers to develop fixes before public disclosure.
The company said the preparation process took two months because addressing the vulnerabilities required a complex change to the PHP engine.
PHP is used in a substantial share of the internet, with OpenAI estimating that it powers around 70% of websites. Its scale means unpatched systems could create significant opportunities for attackers.
