PHP, the language that powers about 70% of the world’s websites, has been found to contain a bug that allows hackers to execute code remotely. Because PHP runs on servers rather than in the browser, the issue affects website backends before the resulting HTML or other dynamic data is sent to users.
PHP released emergency fixes for two of the most critical flaws on the same day. Still, more than one-third of the web remained unpatched at publication time.
Two flaws grouped as PHP2Shell
The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619 and are collectively called PHP2Shell. According to the report, PHP2Shell lets an unauthenticated attacker run code on a web server and return faulty output to a user’s browser. Exploitation can happen even before a website’s own code runs.
Official fixed releases initially covered only PHP 8.2 and newer. That left more than one-third of PHP websites without a patch. By mid-day, backports for older versions from 7.4 to 8.1 were starting to roll out.
One estimate cited in the report said more than 800,000 internet hosts serving content to millions of websites run PHP branches so old that they “will get no fix” at all.
Bug found during an OpenAI-funded audit
A security researcher using OpenAI’s GPT-5.6 Sol model found the bug during an August audit funded by OpenAI. The researcher was part of Calif, a partner in OpenAI’s Patch the Planet program, which pairs frontier models with expert human cybersecurity review.
Calif CEO Thai Duong told The Wall Street Journal that this class of bug had been flagged decades ago but was dismissed as too difficult to exploit. He said AI hackers have now figured out how to take control of a server’s memory within a few dozen requests.
Wiz, a division of Google Cloud, independently confirmed the flaws. A Wiz co-founder called PHP2Shell “the most severe AI vulnerability that was ever found,” adding that it was one humans would probably never have found.
Cloudflare and public agencies respond
Cloudflare CTO Dane Knecht said live exploit vectors were seen for every customer, including free plans. The company put in a stopgap emergency measure overnight, then announced more patches a few hours later.
The impact spread across multiple countries. Finland’s state IT center shut several government web services as a precaution. In the Netherlands, NotuBiz’s council information sites for local governments went offline, followed by MijnOverheid and the Dutch parliament’s website.
A post relayed by Walter Bloomberg on X also said France temporarily took prefecture websites offline pending a PHP fix.
Patched releases and remaining exposure
Patched PHP versions include 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Even so, 27% of PHP sites still run PHP 7, while 7.7% run PHP 5. Those versions remain unpatched. GoDaddy urged customers to upgrade.