Critical vulnerabilities in PHP prompted website operators to take systems offline on October 21, including precautionary shutdowns by the Wikimedia Foundation and disruptions affecting European government websites. The BBC reported additional outages, although their connection to the vulnerabilities remained unconfirmed.
The emergency followed AI-assisted research by cybersecurity company Wiz that identified exploitable weaknesses in PHP's core engine. The incident raises questions about whether software maintainers and organizations can develop and deploy security updates quickly enough as AI accelerates vulnerability research.
How PHP's memory vulnerabilities exposed websites
PHP's October 21 emergency releases addressed CVE-2026-109618 and CVE-2026-109619, both rated critical at 9.2 under CVSS v4.0. The official security advisories describe memory-management vulnerabilities that can allow attackers to execute code remotely without authenticating.
One vulnerability involves PHP's handling of out-of-memory conditions. If processing stops before internal data is fully initialized, cleanup operations may access it incorrectly. The other involves a use-after-free condition, in which software continues referencing memory after it has been released. Both can corrupt memory and, under exploitable conditions, allow attackers to execute code on a vulnerable server.
Since the vulnerabilities affect PHP's core engine, websites built with WordPress, Drupal, or Joomla may be exposed even if their application code contains no corresponding flaw. Administrators must update the PHP runtime itself, since plugin updates cannot resolve weaknesses in the underlying engine.
Wiz's PHP2Shell research demonstrated unauthenticated remote code execution against vulnerable deployments of those platforms. Researchers also showed how attackers could access server-process memory, potentially exposing passwords, authentication tokens, or API keys.
Wiz estimates that PHP powers approximately 70% of websites worldwide. However, that prevalence figure does not mean that 70% of websites were vulnerable to PHP2Shell, since exposure depends on the installed PHP version and other deployment conditions.
How AI helped researchers develop PHP exploits
Wiz reports using its Atlas system alongside Google Gemini 4 Argon and OpenAI GPT-5.6 Sol during the investigation. The company credits Gemini with helping identify vulnerabilities and develop exploits, as well as supporting attack detection and patch validation. Its published account does not quantify the contribution of each AI system.
According to Wiz, AI models helped researchers analyze failed exploit attempts and modify techniques for different PHP configurations. Memory exploits often depend on how a target allocates and reuses memory, so differences between deployments can require substantial debugging. Wiz says AI assistance helped its researchers adapt working exploits across applications in hours.
The investigation began with an initial discovery on August 19, followed by a report to PHP maintainers on August 24. Public disclosure and the emergency security updates arrived on October 21.
Experienced security researchers directed Wiz's investigation, so the findings do not establish how effectively inexperienced users could reproduce the attacks. However, the reported reduction in exploit-development time suggests that AI assistance could make complex vulnerability research more accessible to attackers with relevant technical knowledge.
Wiz's demonstrations establish that the vulnerabilities were exploitable under tested conditions, while separate reports indicate that attackers had targeted live systems. On October 21, the Financial Times reported Amazon's statement that the flaws were being broadly exploited, including an attempt detected four days before public disclosure. The available reporting does not establish whether those attackers used AI.
Why emergency patches prompted website shutdowns
The UK National Cyber Security Centre urged organizations to identify PHP installations throughout their infrastructure, prioritizing internet-facing systems. It advised considering shutdowns when patches or temporary mitigations could not be applied promptly, while CERT-EU recommended isolating vulnerable systems until fixes could be installed and verified.
Disconnecting a vulnerable website can prevent further exposure while administrators install updates, but it also interrupts legitimate access. Organizations therefore need established procedures for deciding when to suspend services, especially when the risks of continued operation exceed the consequences of an outage.
PHP released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to address the vulnerabilities. According to the PHP project, updating provides the complete remedy, while temporary configuration changes may block only particular attack methods.
Organizations running PHP 8.1 or older must check whether their operating-system vendor provides backported fixes. Although PHP supplied minimal source backports for selected older branches, administrators should confirm that their installed packages contain the security corrections or migrate to supported versions.
PHP maintainers faced years of repair challenges
The PHP Foundation's account shows the emergency involved more than the discovery of previously unknown vulnerabilities. Maintainers had considered a possible out-of-memory exploit in 2024 but lacked a demonstrated attack route. Proposed repairs carried compatibility risks, while limited staffing contributed to repeated delays.
The Foundation also reported that Calif and OpenAI submitted remote-code-execution findings on August 11, before Wiz's disclosure. Multiple research efforts contributed to identifying exploitable weaknesses, even though Wiz's PHP2Shell investigation drew particular attention to the use of AI in exploit development.
AI-assisted research can increase the number of vulnerability reports that maintainers must investigate. Security funding must cover report triage and patch development, while organizations running PHP must allocate resources to test and install updates across their systems.
Since July 1, the PHP Foundation reports publishing 15 CVEs while processing over 100 submissions that proved invalid, duplicative, or impossible to reproduce. Although AI tools can help validate findings, human maintainers remain responsible for assessing reports and preparing security fixes.
These demands are especially significant for widely deployed open-source software. A vulnerability in a core runtime may affect numerous applications, but producing a reliable fix requires compatibility testing across environments maintainers don't directly operate.
Why PHP moved its security release forward
PHP originally planned to release the fixes on October 22 but moved publication forward by one day after the CVE identifiers circulated publicly. According to the PHP Foundation, a prematurely published demonstration video later revealed additional information about exploitation.
Distributors were still preparing update packages, making immediate public disclosure risky for organizations that couldn't install a readily available fix. The accelerated release therefore had to account for the time needed to prepare deployable updates while reducing the risk posed by information already circulating.
Coordinated disclosure requires maintainers to test fixes and distributors to prepare packages before technical details become widely available. However, sharing vulnerability information with more organizations ahead of publication also increases the number of places from which sensitive details could leak.
OpenAI's proposed coordination framework addresses these competing requirements through maintainer-led preparation and selective advance disclosure. It also recommends reassessing release timelines when leaks or evidence of active exploitation change the security risk.
PHP2Shell shows how AI-assisted research can reduce the work required to develop exploits for long-standing software vulnerabilities. The incident also exposed the demands on maintainers and distributors when they must prepare security fixes before technical details spread publicly.
The PHP Foundation's account identifies engineering resources and compatibility concerns as significant barriers to resolving the underlying weaknesses. As AI systems accelerate vulnerability research, reducing exposure will depend on whether maintainers can validate reports, produce reliable patches, and give organizations a dependable path to deployment.
