Hackers Are Breaking Into Websites Through Two Known PHP Flaws. Here Is What to Do.
The U.S. government has confirmed that attackers are actively using two serious flaws in PHP, a programming language that runs a large share of the world's websites. It has ordered U.S. civilian federal agencies to fix their systems within three days.
The flaws are tracked as CVE-2026-109618, a PHP Memory Corruption Vulnerability, and CVE-2026-109619, a PHP Stale Internal Request-State Vulnerability. Both let someone take control of a server over the internet without a password, according to TechCrunch.
On 26 October 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added both flaws to its Known Exploited Vulnerabilities Catalog. Five days earlier, on 21 October, the agency had published an alert titled "Critical Vulnerabilities in PHP Require Immediate Patching." It called the flaws "php2shell" and said they allow unauthenticated remote code execution. In plain terms, an outsider can run their own commands on the machine without logging in (CISA).
PHP is used by about 70% of web-facing servers, the computers that deliver websites to visitors, TechCrunch reports.
The fix came first. The PHP project released a security update on 21 October 2026 at 14:00 UTC, with patched versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (PHP.net). That meant the patches were public less than a week before CISA's warning. The project named both flaws as the two critical issues in that update.
The problem is older than the update. TechCrunch reports that the flaws were first found two years ago. The maintainer, the person who looks after the code, did not fix them because they concluded there was no practical way to exploit them. Earlier this year, researchers at the security firm Calif found a way to use the flaws with help from an AI model. The bugs are now known as PHP2Shell.
OpenAI says it led a coalition of maintainers, researchers and security companies for two months to address the flaws. It published its account of this coordinated effort on 21 October 2026 (OpenAI).
The broader context here is the gap between a flaw being judged hard to exploit and that flaw actually being used by attackers. The maintainer's judgment was a reasonable reading at the time. The Calif work suggests that the judgment can change once a capable AI model is pointed at the problem. It is a little like a window latch that everyone agreed was too stiff for a burglar, until someone found a tool that opened it easily. Security teams that set aside issues labeled "not currently exploitable" may need to check those labels more often.
For people who run these websites, the immediate steps are clearer. Three days is a short deadline, and the patch has been public for under a week. The attack does not need a password. Any PHP system that can be reached from the internet belongs on the list. That includes shared hosting, the back-end admin areas of content management systems, and internal tools made reachable through a proxy. Installing the fixed version is the straightforward remedy. Checking that the update reached every web-facing machine, including containers (sealed-off copies of software) and forgotten test servers, is where most of the work will be.
In my view, the most useful lesson for people who run this software is about process. The patches existed before the public warning, so the coordination worked in that sense. The risky period was the gap between a fix being released and every installed copy being updated. That gap depends on how quickly organisations schedule and approve changes, and an advisory alone does not close it.
