Two extremely dangerous security loopholes in the PHP programming language have raised an unprecedented state of cyber alert in a number of countries around the world, after recent security research revealed that they can be exploited to penetrate and control website servers remotely, without the need to possess data Log in.
These developments prompted governments, institutions and technology companies to take urgent preventive measures, including temporarily disabling some digital sites and services, in conjunction with the issuance of warnings from US and European security authorities demanding institutions to install the necessary updates immediately, or isolate vulnerable systems from the Internet until they are secured.
Despite the breadth of warnings and the recording of millions of attempts to exploit and scan across some networks, reports available as of Friday morning did not prove a wide wave of successful hacks. Experts confirm that The absence of evidence of successful large-scale attacks does not negate the severity of the crisis, especially as attackers continue to search for systems that have not yet received security fixes.
Whatis the story of the two gaps that have raised global concern?
The crisis is due to the discovery of two security flaws in The core components of PHP, which is one of the most widely used programming languages in the development of websites and applications, and works behind popular systems such as WordPress, Drupal and Joomla, as well as technologies that interfere with the operation of Wikipedia, online stores and various digital services.
The Cybersecurity company Wiz estimates that PHP is used to power about 70% of websites, an estimate that reflects the spread of language, but it does not necessarily mean that all of these sites are vulnerable to exploitation in the same way.
The two gaps carry the security identifiersCVE-2026-109618 andCVE-2026-109619, each with a risk rating of 9.2 out of 10 on the CVSS criterion, placing them in the critical gaps category.
The problem lies in internal mechanisms related to memory management and request processing within PHP. In certain circumstances, software errors can cause dealing with Invalid data or reuse of previously edited associated memory information.
These errors may allow attackers to execute malicious code on servers, or access sensitive information stored in memory, including passwords and keys to access digital services and user data.
The most serious is that the bug is in the PHP engine itself, not necessarily in the site's code, which means that updating the CMS alone may not be enough to remove the risk.
Artificial Intelligence Reveals Errors That Have Been Hidden for Over a Decade
The role of Artificial intelligence as one of the most important aspects of this crisis, after it helped security researchers discover old vulnerabilities and turn them into practical exploitation scenarios.
OpenAI announced that researchers from the Calif Group used the GPT-5.6 Sol model to discover a vulnerability within the Patch the Planet initiative. which aims to accelerate the detection and remediation of security issues in collaboration with software developers and security organizations.
In an independent research trajectory, Wiz identified vulnerabilities using advanced analytics tools, including artificial intelligence models and specialized code scanning techniques.
According to published information, some basic problems have existed for more than ten years, but the complexity of exploiting them has made it difficult to deal with them as a practical threat in the past.
Modern AI tools have helped reduce the time and effort needed To understand complex errors and test their exploitability, a development that reflects an important shift in the nature of cybersecurity research.
But at the same time, these capabilities raise concerns that they could be used by malicious actors to develop means of penetration faster, and reduce the period available for organizations to overhaul their systems.
Government websites and companies that are preemptively discontinuing their services
The repercussions of the two loopholes did not stop at the issuance of security alerts, but extended to the disruption of a number of digital sites and services in Europe and other regions of the world.
You have stopped Government agencies in Finland and the Netherlands are temporarily providing e-services during the implementation of protection measures, and sites belonging to public institutions and other online platforms have been affected.
In Britain, the authorities revealed the suspension of 32 sites or services limited in scope as a precautionary measure, while witnessing linked pages In media institutions and local services, there are cases of disruption or temporary suspension.
Wikimedia Foundation, which oversees Wikipedia, announced precautionary measures, including suspending some systems until updates are completed and validated.
French telecom company Orange also suspended access to some its services during the implementation of the reforms, while concerns have spread to other sectors that rely on PHP in their technical architecture.
These actions illustrate the scale of global reliance on common software components, where a single flaw in a widespread technology can push completely different organizations to Make concurrent decisions to protect its services.
However, the cessation of these sites is not evidence that they have been hacked, as many institutions have chosen to temporarily suspend their services to avoid risks before any successful attack occurs.
Hacking Attempts in the Millions.. But Where are the Attacks Successful?
Despite the concerns associated with the two loopholes, initial security assessments showed a discrepancy between the large volume of exploitation attempts and the evidence available on the success of the attacks.
Cloudflare reports a rapid upsurge in activities associated with exploiting vulnerabilities Following its announcement, attempts rose from thousands to tens and hundreds of thousands, and then reached millions across its network.
In contrast, Don Smith, vice president of threat research at Sophos, said the data his team analyzed showed two actual attempts to exploit within the scope of Monitoring available to the Company.
Leading security companies also reported that, as of Thursday evening, they had not detected firm evidence of successful large-scale breaches.
This discrepancy is not necessarily a contradiction; companies monitor different networks and systems, and there are differences between automated inspections. and actual exploitation attempts, and attacks that succeed in taking control of systems.
For its part, Amazon Web Services revealed an attempt to exploit a vulnerability dating back to October 17, four days before the public announcement of the reforms, using dedicated security monitoring systems to monitor the behavior of Attackers.
This indicates that some entities began testing vulnerabilities before their official disclosure, but the success of these attempts on real servers was not confirmed in the published information.
Security experts warn that the coming period may see an increase in attempts to attack, with the spread of Technical details of the vulnerabilities and the continued existence of servers running out-of-date versions.
Urgent security updates and warnings from government agencies
On October 21, 2026, PHP developers released emergency security updates to address the two gaps, including the following versions:
PHP 8.5.12
PHP 8.4.27
PHP 8.3.36
PHP 8.2.35
The language development team confirmed that installing repairs is the primary measure to fully address the risk, noting that temporary protections may limit some attack paths, but they do not represent a substitute for updating Affected Systems.
The US National Security Agency (NSA) and European cybersecurity authorities issued urgent warnings demanding the identification of all systems that use PHP, and giving priority to servers and services connected to the Internet.
The competent authorities also recommended the suspension of Systems that are temporarily compromised if appropriate security fixes cannot be implemented at the required time.
The task is even more difficult for organizations that rely on older versions that are no longer officially supported, foremost among which is PHP 8.1 and above, as they may need to upgrade systems or Obtain approved security patches from support providers.
In a further development on Friday, October 23, the PHP project posted an alert regarding another rare scenario that may result in remote code execution when certain settings meet, and recommended temporarily disabling session.upload_progress.enabled in the context of deal with that risk, until a later fix is issued.
What are the risks for businesses and website owners?
The crisis is a direct challenge for companies that rely on websites to manage sales, receive orders, or save customer data, especially Organizations that do not have specialized teams to constantly monitor security updates.
If an attacker succeeds in exploiting a vulnerability of this type, the consequences may include accessing sensitive databases, changing website content, disabling services, or using the compromised server for... Other malicious electronic activities.
Risks become more sensitive in the financial, commercial and governmental sectors, given the nature of the information held by these systems and the users’ reliance on them.
Specialists advise website owners to check the version of PHP being used server, contact the hosting provider to verify that updates are installed, and review systems logs to monitor any abnormal activity.
You should also ensure that additional software components are updated, and scan servers that indirectly use PHP, such as control panels and internal services and embedded systems.
Using WordPress or any PHP-based platform does not mean that the site has already been hacked, but it does make checking the version used on the server a necessary step.
As for the average user, he usually does not need to modify his personal device due to these vulnerabilities. Because the problem is mainly related to the servers. However, it is still important to be aware of official alerts and scam attempts that may take advantage of word of mouth.
The PHP crisis reveals a new challenge for the future of cybersecurity
Recent developments highlight a shift The relationship between artificial intelligence and cybersecurity is accelerating, after smart tools have become able to help discover software errors that traditional screening methods have been unable to turn into practical threats for years.
On the other hand, the crisis reveals the associated challenges With the global reliance on open source software projects, they sometimes rely on maintenance teams with limited resources compared to the massive amount of use of this software.
The main challenge is that discovering a vulnerability is no longer the end of the security research process, but rather the beginning of a race between... Developers working to shut it down and attackers seeking to exploit it before fixes reach all affected systems.
Although no large-scale breaches had been confirmed as of Friday morning, continued exploitation attempts mean that the wave of warnings has not ended Equals to the end of the threat.
The PHP crisis remains a true test of the global technology sector's ability to respond to critical vulnerabilities, and a reminder that securing the Internet does not depend only on developing more advanced technologies, but also requires continuous software maintenance and rapid cooperation between... Researchers, companies and governments.
The two vulnerabilities that sparked global concern not only revealed a flaw in a widespread programming language, but also revealed a new reality in which artificial intelligence has become able to change the speed of discovering and exploiting vulnerabilities, which forces organizations to... Rethink the way it protects its digital infrastructure.
