Millions of websites could be exposed to cyber attacks due to some CRITICAL vulnerabilities identified in the code of PHP, a programming language used by approximately 70% of websites worldwide. The two flaws, which have remained hidden for years, could allow hackers to take control of servers, steal confidential information and modify the contents of online pages. The discovery of these flaws, which remained latent for decades, was made by researchers from the security agencies Calif and Wiz, who used advanced tools based on artificial intelligence. On October 21, PHP developers released security updates to fix them, while several authorities called on organizations to take immediate action or, alternatively, temporarily disable vulnerable sites.
Wiz, one of the two companies that found the vulnerabilities, explained that «These discoveries are among the most serious vulnerabilities ever identified in PHP and, probably, in the history of the software». OpenAI, which provided the AI tools with which the flaws were identified, defined the discovery as «one of the most serious security problems of recent times». Let’s take a closer look at what happened and how this affects each of us closely.
What is the PHP language and what is the risk with the flaws discovered in websites
To understand the scope of the problem reported by cybersecurity experts, we must first understand what PHP technology is. Let’s start from the meaning of this acronym: PHP stands for Hypertext Preprocessor. It is a programming language used above all to create dynamic websites, i.e. capable of showing content that changes based on user requests or information present in databases. It is considered by many to be a sort of backbone of the Web, as this language runs through a large part of the internet, given that it is the basis of numerous platforms for managing the contents of Internet sites, including WordPress, Joomla, Drupal and MediaWiki.
You have already understood where we are going: if PHP technology has a vulnerability and if this technology is used in one way or another in the construction of a large part of websites, you understand well that the flaws found by researchers are of enormous importance. This is not news that simply concerns nerds and enthusiasts of this world: but it concerns all users who use the Web.
Zooming in on the issue, we see that the cybersecurity researchers at Wiz, who together with those of the company Calif have identified the flaws, the vulnerabilities affect the versions of PHP released in the last decade, starting from 5.4. Issues identified include flaws in memory management and the ability to execute code remotely without authentication. Memory management concerns how a program uses the resources needed to process information, and a flaw here can make data that should remain protected accessible to attackers. Remote code execution, on the other hand, allows a cybercriminal to issue instructions to a system over a network, without having to physically be in front of the computer. Furthermore, the absence of authentication makes the risk particularly serious, because the attacker may not need to prove his identity to attempt to exploit this particular flaw.
If an attack were successful, the consequences could include the theft of sensitive data, server takeover, and even modification of published pages. How serious are the two flaws discovered by the researchers? To understand this you must keep in mind that both, both the one marked with the code CVE-2026-109618 and the one classified as CVE-2026-109619, received a score of 9.2 on the CVSS v4.0 scale, which goes from 0 to 10 (with 10 being the worst recordable score).
The contribution of AI
What makes the story particularly relevant is the contribution that artificial intelligence has had in all of this. Yes, because the researchers used advanced, so-called frontier, models capable of analyzing enormous quantities of code in much quicker times and this made it possible to identify potentially dangerous problems with a speed that is difficult to achieve through traditional checks alone. The defects, according to experts, had been present for decades. You read that right, they have existed for decades. AI has made it much easier to spot them.
But be careful. The same technology, in the wrong hands, could be used by unscrupulous cyber criminals to exploit these (so far unknown) flaws to their advantage. Once technical details become public, other cybercriminals can study them to build an exploit, which is a method or program that exploits a flaw in the system to cause unexpected behavior in software. For this reason, experts fear that attack attempts may increase in the weeks following the disclosure of the attack.
The European response and how to protect yourself from the two vulnerabilities
The international response was swift. In Germany, the federal IT service provider ITZBund took several sites offline as a precaution, stating that there were no security incidents. In France, the Ministry of the Interior has temporarily suspended prefecture portals pending a fix. Belgium has adopted similar measures, while in the Netherlands public services, hospital websites, the port of Rotterdam and portals of various political parties have been taken offline. Finland and the Czech Republic have also suspended some government services. The Wikimedia Foundation, the organization that manages Wikipedia, has also temporarily removed some systems to protect them until they are repaired.
Of course, pre-emptively deactivating these sites does not necessarily prove that they have already been attacked. This was presumably a preventative measure taken to prevent anyone from exploiting the vulnerability before installing the updates. PHP developers, yesterday, Wednesday 21 October, released a security update which should have resolved the problems highlighted by the researchers.
Site managers have a responsibility to promptly install available updates and also to verify that systems have not already been compromised in some way. Authorities of the caliber of National Cyber Security Center of the United Kingdom, for example, have also sent to check for the possible presence of backdoors. Simple Internet users who surf online don’t have much to do to defend themselves, other than hope that the websites they regularly visit are implementing these security patches.
