Multiple vulnerabilities in the open-source scripting language PHP (Hypertext Preprocessor) have taken the internet by storm and sent ripple effects across the globe, prompting responses from big tech companies and governments worldwide, with notable ones being India’s CERT-In, the United States’ Federal Bureau of Investigation, OpenAI, Google and more. The extent of the flaws can be assessed from the fact that all individuals and organisations using PHP-led websites (which includes 70 per cent of the websites) are affected. The Indian Computer Emergency Response Team said the security issues could allow remote attackers to execute arbitrary code on a targeted system.
In a security advisory, PHP said “PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35” fixes two “critical vulnerabilities” that may allow unauthenticated code execution remotely, which implies hackers can target websites to launch unwanted behaviour for personal gain.
Also Read: PHP security flaws explained: Affected versions, how to fix and more details
PHP users are advised to update immediately. As per the company, the risk is highest for mod_php, where an “unauthenticated request” may trigger attacks before any application code runs. For the unaware, PHP is built for server-side web development of dynamic web pages.
CERT-In (Indian Computer Emergency Response Team) raised a “critical” security alert flagging critical remote code execution vulnerabilities in PHP. “Multiple vulnerabilities have been reported in PHP which could allow a remote attacker to execute arbitrary code on the targeted system,” CERT-In said in its vulnerability note. This could “compromise” the system completely. “These vulnerabilities exist in PHP due to memory corruption and improper resource control.”
CERT-In has published Vulnerability note on its website. Critical remote code execution vulnerabilities in PHP https://t.co/DBHzWvOM5t
— CERT-In (@IndianCERT) October 21, 2026
ChatGPT notes that the programming language is used to run around 70 per cent of websites. OpenAI was among the team of researchers and companies preparing the fix in the PHP engine over the last two months. “Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors,” @OpenAI said in an X post.
“Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory,” the ChatGPT maker noted.
Noting these critical vulnerabilities, the Cyber Division of the FBI said: “It is recommended that organisations take the system offline until it can be fully mitigated.” While urging users to immediately update the affected PHP installations, it requested users to monitor web servers for suspicious activity.
Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks. The FBI urges organizations to take the following steps now: ➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated. ➡️ Immediately update affected PHP installations following the guidance on https://t.co/rDrPSxB3zX. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP. ➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation. ➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or https://t.co/iqgVZIbCru. Those reports help us identify the actors involved and warn other organizations before they become victims. For the latest information, follow PHP’s announcement on https://t.co/rDrPSxB3zX, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.
— FBI Cyber Division (@FBICyberDiv) October 21, 2026
The activity includes “PHP processes unexpectedly launching command shells or downloading files.” Users were advised to isolate an affected system and preserve the web server and PHP logs.
Google said Gemini 4 Argon and Wiz Research contributed to discovering this flaw. “Users of PHP running on Google Cloud may be vulnerable,” Google said. “We urge all customers running PHP applications on Google Cloud to immediately update to PHP 8.2 or newer, and redeploy their services using a patched version.”
WordPress noted the issues are not specific to it. The platform said an update is not required for WordPress. However, it added that site owners were advised to check with hosting providers and add firewall guardrails.
PHP said users must update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 immediately. Users on Linux distributions and LTS must check with their vendors for update packages. Upgrading is the only “complete solution” for these vulnerabilities.