Critical vulnerabilities in the PHP web scripting language could allow hackers to take control of any website running the widely used software, PHP’s developers said on Wednesday, as they released emergency updates that sent website owners scrambling to fix the flaws.
“All PHP users are strongly encouraged to update immediately,” the developers said in a security advisory about the new versions, which fix vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. Both vulnerabilities could allow hackers to execute malicious code on and potentially take control of websites developed using the popular open-source scripting language.
“These vulnerabilities often provide a direct path to the server’s file system or database,” the National Security Agency said on social media.
The scope of the potential damage associated with the PHP vulnerabilities remains unclear, but one researcher estimated that more than 1.3 million websites are vulnerable. Google-owned security firm Wiz said PHP “powers 70% of all websites in the world.”
“These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history,” Wiz researchers wrote in a blog post.
Government cybersecurity agencies around the world, including in the U.K., Canada and Australia, as well as the European Union’s cybersecurity emergency unit, urged website operators to take their sites offline until their PHP versions could be updated. Some organizations, including the government of Finland and the Dutch House of Representatives, disconnected their sites from the internet on Wednesday.
Researchers at the security firm Calif discovered the PHP vulnerabilities using OpenAI’s GPT-5.6 Sol model, OpenAI said in a statement. (Wiz, which also independently discovered the flaws, said it too used frontier AI models to find them.)
“Given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory,” OpenAI said. “It highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits.”
OpenAI said it coordinated the patching process with U.S. and foreign government agencies, including the Cybersecurity and Infrastructure Security Agency and the White House’s Office of the National Cyber Director.
——————————————————-
Click Here For The Original Source.
