Key Points
・On October 21, 2026, the PHP maintainers released fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10 under CVSS v4.0, according to the PHP project, and services in Japan and Europe went offline as a precaution while operators prepared to update.
・Signs of one of the two flaws were found in a 2024 audit, but the fix stalled; in August 2026, researchers using AI found the flaws, according to the PHP Foundation and NOS.
・AI made finding and demonstrating the flaws faster, but checking reports, writing the fix, distributing it and installing it on each server were done by small maintainer teams, distributors, hosting companies and site operators, and who pays for that work after discovery is not settled.
PHP Patches Two Critical Flaws as Services Pause Worldwide
On October 21, 2026 (the night of October 21 in Japan), the maintainers of PHP, the programming language that runs behind a large share of websites, released new versions that fix two serious flaws, according to the PHP project’s advisory. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
The flaws, CVE-2026-109618 and CVE-2026-109619, were each rated 9.2 out of 10 under the CVSS v4.0 scoring system, according to the project’s security advisories on GitHub. Under the right conditions, an attacker could take over a server without logging in.
According to ITmedia NEWS on October 22, 2026, services in Japan paused as a precaution after the advance notice, including Codmon, a communication service for nurseries and parents, and BASE, a platform for building online shops, along with financial, railway, game and video services. Codmon restarted most functions early on October 22, and BASE finished its emergency maintenance that morning, according to the two companies’ notices.
In the Netherlands, the DigiD login system for government services went offline, and France’s interior ministry temporarily closed prefecture websites, according to the Dutch public broadcaster NOS on October 21, 2026.
Prime Minister Sanae Takaichi (@takaichi_sanae) posted on X at 9:55 p.m. on October 21 (Japan time), calling it an “extremely urgent request” and asking site operators to check whether they use PHP and to prepare to apply the patch due at 11 p.m. She added that temporarily stopping a site is one effective way to reduce the risk if a quick update is difficult.
皆様に、今夜に対応して頂きたい大至急のお願いです。
— 高市早苗 (@takaichi_sanae) October 21, 2026
多くのウェブサイトで使用されているPHPに関し、PHPのセキュリティチームが、重大な２件の脆弱性に関する注意喚起を行っています。…
The Dutch National Cyber Security Centre and the U.S. Cybersecurity and Infrastructure Security Agency had not seen active exploitation as of October 21, according to NOS. Cloudflare said it observed attack attempts and added protections.
Related Articles
What PHP Runs, and Who Installs a Fix
PHP is a shared foundation for very different services
PHP is a programming language and runtime that executes code on web servers, the part of a site that reads member data or accepts orders and applications. According to W3Techs in October 2026, 69.3 percent of websites whose server-side language can be identified use PHP, and that share is measured only among sites where the language could be detected.
The services that paused in Japan and Europe had little in common on the surface: government logins, nursery communication tools, online shops and news sites. What they share is a server that takes a user’s input, processes it and sends back a page. WordPress, the widely used blogging and site-building software, is one of many applications that run on top of PHP.
Three layers: the foundation, the application and the operator
A web service can be pictured in three layers. PHP sits at the bottom as the foundation. Applications such as business systems, online shops and WordPress sit on top. Then there are the companies and organizations that run everything on real servers.
These flaws were in the bottom layer. Updating an application does not replace the foundation, so PHP itself has to be swapped for the fixed version. The PHP maintainers write the fix, Linux distributors and enterprise support vendors package it, and the organization that runs the server, or the hosting company for rented servers, installs it. The same flaw takes a different amount of time to close depending on who sits in which layer.
| Branch | First fixed release |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
Versions 8.1 and older no longer receive regular updates from the PHP project, according to its advisory. As an exception, the security team published minimal source fixes for 7.4, 8.0 and 8.1, intended for people who build PHP themselves or have no long-term support vendor.
A cleanup problem after errors
There were two flaws. One was in how PHP cleans up when it runs out of memory, the working space it uses while handling a request. The other let information from one request survive and be used by the next request. Both resemble a desk left half cleared when work is cut off, then used by the next person.
The setup that runs PHP inside the Apache web server was the most dangerous, according to the PHP project, which said a demonstration showed impact before a site’s own code began to run. Meeting the conditions is not easy, but no login and no action by a user are required.
From a 2024 warning sign to the 2026 release
Signs of the memory cleanup flaw appeared in a 2024 external audit, according to the PHP Foundation.
In August 2026, the security firm Calif, working with OpenAI and using AI, found the flaw, according to NOS, and Wiz, a company owned by Google, also reported on August 24 using several AI models, according to Wiz.
Finding Is Faster, Fixing and Delivering Are Not
Why did a known warning sign stay unfixed?
The 2024 sign stayed unresolved because nobody could show it was exploitable, and the PHP Foundation said candidate fixes carried costs such as broken compatibility. Decisions needed consensus among few core experts, and the Foundation called the delay a “structural failure.”
A flaw that may or may not be usable in an attack tends to wait behind flaws that clearly are. With a small team weighing compatibility against safety, that pull is stronger.
What AI shortened was the time to show a flaw is usable
In 2026, researchers using AI demonstrated that an attack really worked. A demonstration here means confirming the attack in a controlled test environment, built from publicly available software such as WordPress, according to Wiz’s PHP2Shell site. Wiz said one researcher using advanced AI models did in a week what a top team once needed months to do, according to NOS.
The 2024 work had stalled; in 2026 a working demonstration arrived, and the fix and release were then coordinated under the maintainers’ lead. The demonstration was one of the events that changed what had to be fixed first. From discovery to fix, three roles were involved: researchers using AI, maintainers who wrote the patch, and companies that helped coordinate.
More reports mean more sorting
Since July 2026, the team has handled more than 100 invalid, duplicate or unreproducible reports from all sources, not only AI, according to the PHP Foundation. Separately, it said AI-assisted research has increased reports; people still decide and write the fixes.
The faster finders work, the more work lands on those who must check whether a report is real and how dangerous it is. OpenAI said in October 2026 that it expects similar findings to rise sharply in the coming months.
Information moved faster than the fix
The timing of a release is a tug of war. Giving distributors and large operators time to prepare means more users are protected the moment the fix appears. Once information leaks, every hour of waiting gives attackers more time.
According to the PHP Foundation, the CVE numbers leaked with a wrong 10.0 score, the release moved up a day, and a security firm accidentally posted a demo video. Purported analysis spread before packages were ready. The Foundation said proof-of-concept code it checked contained no working attack by release, leaving operators to decide amid rumor.
OpenAI proposed a five-stage process for delivering fixes in October 2026, in which maintainers decide who gets advance notice. Organizations told early can prepare, and those not told must act at the moment of release. Cloudflare said its web application firewall, a filter that blocks malicious traffic in transit, added default protections from 3:02 a.m. UTC on October 21, while stressing that PHP still needed to be updated.
Operators had to weigh stopping against staying online
Until the fixed version was installed, operators had to compare the loss from stopping a service, such as halting government procedures or nursery messages, with the risk of being attacked if they stayed online. Many chose to pause. The prime minister’s post itself listed a temporary stop as one effective way to reduce risk.
The Dutch justice minister said the precautionary shutdown of many sites was having an impact on the digital society, according to NOS. In Japan, the IPA, the government-backed information security agency, asked organizations on October 21 to check whether their sites and products use PHP, because PHP can be built into products where users cannot see it.
Who pays for the work after discovery?
The money behind the work after discovery came from several places. The 2024 audit was funded by a German government-backed fund, according to the PHP Foundation, and Calif’s 2026 work ran under OpenAI’s Patch the Planet program, according to OpenAI. OpenAI also announced $1 billion in subsidized AI access for organizations that protect essential services.
The PHP Foundation asked companies that build on PHP, hosting providers, cloud platforms, distributors and governments for sustained support. Much of the world uses PHP for free, and the depth of the maintainer bench depends on whether that support continues. Whether the same capacity is in place for the next discovery is an open question. A longer-term option, which OpenAI also mentions, is moving core components to languages that make memory errors harder to write.
Japanese Reactions to the PHP Vulnerability Alert
This section covers five posts on X that we selected from widely shared Japanese posts. They are reactions on X, not a measure of Japanese public opinion. Among these five, the prime minister, an opposition party leader and a government agency posted the same practical message, patch tonight or pause the site, while a game news site and an AI researcher reacted to what the episode meant beyond the patch. Each quote below is a short continuous excerpt, translated from Japanese, and any claims inside a post are the poster’s.
The prime minister’s post had about 281,000 likes when we collected it.
皆様に、今夜に対応して頂きたい大至急のお願いです。
— 高市早苗 (@takaichi_sanae) October 21, 2026
多くのウェブサイトで使用されているPHPに関し、PHPのセキュリティチームが、重大な２件の脆弱性に関する注意喚起を行っています。…
“An extremely urgent request for all of you, to act on tonight.”
Sanae Takaichi, Prime Minister of Japan, October 21, 2026 (excerpt, translated)
The rest of the post asked operators to check for PHP, prepare the 11 p.m. patch and consider pausing sites, as summarized in the News section. ITmedia NEWS described the request as unusual and reported that engineers expected it to reach company executives.
An opposition party leader posted a similar warning that night.
【警告】
— 玉木雄一郎（国民民主党） (@tamakiyuichiro) October 21, 2026
PHPのセキュリティチームが、重大な２件の脆弱性に関する注意喚起を行っています。
ウェブサイトでPHPを使用している場合、今夜午後11時に公開される修正パッチを速やかに適用してください。
高市総理及び国家サイバー統括室からも同様の注意喚起が行われています。 https://t.co/Y46KOnNtjC
“If you use PHP on your website, please promptly apply the patch to be released tonight at 11 p.m.”
Yuichiro Tamaki, leader of the Democratic Party for the People, October 21, 2026 (excerpt, translated)
His post also noted that the prime minister and the National Cybersecurity Office had issued similar warnings.
An AI researcher read the news as a sign of what is coming.
今回のPHP脆弱性を発見したのはOpenAIだったという発表
— 今井翔太 / Shota Imai (@ImAI_Eruel) October 21, 2026
現状のデジタル空間・インターネットの仕様はおそらく今後出てくるAIの能力に耐えられないと思うので、特定組織のセキュリティレベルではなくデジタル空間再編のためのフロンティアモデル需要が出てくるのではないかと個人的に考えている。 https://t.co/sLtpGXLLV1
“Personally I think there will be demand for frontier models not for the security level of individual organizations but for reorganizing the digital space.”
Shota Imai, AI researcher, October 21, 2026 (excerpt, translated)
His post opened by citing an announcement that OpenAI had found the flaw. According to OpenAI and Wiz, Calif found it using an OpenAI model and Wiz found the flaws independently with several models, while PHP’s maintainers wrote the fix.
A game news site’s post, with about 28,000 likes when we collected it, was about a well-known website.
「阿部寛のホームページ」がXでトレンド入り。PHPの脆弱性対策のため緊急メンテナンスを実施https://t.co/WErrzf5BIl
— 電ファミニコゲーマー (@denfaminicogame) October 21, 2026
高速表示で知られる同サイトが閲覧できなくなりSNS上で驚きの声が広がる。ページの公開に利用しているサービス自体のメンテナンスによるもの pic.twitter.com/RyVGfhZS7w
“‘Abe Hiroshi’s Home Page’ trends on X. Emergency maintenance to address the PHP vulnerability.”
Den Faminico Gamer, Japanese game news site, October 22, 2026 (excerpt, translated)
The official site of actor Hiroshi Abe is known in Japan for its simple, fast-loading design. The post said the outage came from maintenance by the service the page uses to publish, which made the hosting layer of this story visible to ordinary users.
The next day, the government’s cybersecurity office posted a formal alert.
【注意喚起】
— 国家サイバー統括室(注意・警戒情報) (@cyber_forecast) October 22, 2026
2026年10月22日、PHPにおける複数の脆弱性（CVE-2026-109618、CVE-2026-109619：PHP2shell）に関する件として、IPAが注意喚起をしています。ご確認ください。https://t.co/HwnBsFo0Nj
“Regarding multiple vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619: PHP2shell), the IPA has issued an alert. Please check it.”
National Cybersecurity Office (Alerts and Warnings), October 22, 2026 (excerpt, translated)
In these five posts, the focus was on installing the fix and on familiar sites going dark, more than on who found the bug.
Who Finishes the Fix After AI Finds the Flaw
Can the work after discovery keep pace?
In this case, AI made the finding faster. The fix that had stalled since the 2024 warning sign reached release a little over two months after the flaws were shown to be exploitable.
The work after discovery was carried by different hands at each stage: small maintainer teams to check and fix, distributors and hosts to deliver, and organizations everywhere to install. This time the strain showed up as services pausing across several countries while they waited for the fix.
OpenAI expects similar findings to rise sharply. Whether the system can finish a fix depends less on how fast flaws are found than on who supports the later stages with people and money. Governments and companies run services on the same foundation, so how to share that cost is a question for everyone who uses it.
Frequently Asked Questions
What is PHP2Shell?
PHP2Shell is the name used by Wiz’s research site for two critical flaws in PHP, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10 under CVSS v4.0, according to PHP’s security advisories. Under the right conditions they could let an attacker take over a server without logging in. PHP released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, 2026.
Does updating WordPress fix the PHP vulnerability?
No. The flaws are in PHP itself, the foundation that WordPress and many other applications run on, so updating an application or plugin does not replace PHP. The server’s PHP must be updated, by the site operator or by the hosting company, and Cloudflare said in October 2026 that its firewall protections do not remove the need to update PHP.
Were sites actually hacked?
As of October 21, 2026, the Dutch National Cyber Security Centre and the U.S. CISA had not seen active exploitation, according to NOS, and Japan’s IPA had not confirmed attacks when it issued its notice. Cloudflare said it observed attack attempts. Many services in Japan and Europe paused as a precaution, which is different from a confirmed breach.
How did Japanese social media react to the PHP vulnerability?
Among the widely shared Japanese posts we selected on X, Prime Minister Sanae Takaichi’s “extremely urgent request” of October 21, 2026 had about 281,000 likes when collected, an opposition leader and the government’s cybersecurity office posted similar warnings, and a post about a famous actor’s homepage going down for maintenance drew attention. This is a selection from X, not a measure of Japanese public opinion.
Sekahan on YouTube
We publish video summaries of articles like this one, along with short clips built around Japanese reactions.
Reference Links
- PHP News Archive 2026 (Security advisory: Critical remote code execution vulnerabilities) | PHP
- Today’s PHP Security Release, and How We’re Strengthening PHP Security | The PHP Foundation
- Patch the Planet: global response coordination as agents uncover critical vulnerabilities | OpenAI
- PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | Wiz
- PHP2Shell | Wiz
- Cloudflare deploys protections against php2shell vulnerability | Cloudflare
- MijnOverheid en DigiD weer online (in Dutch) | NOS
- PHP’s critical vulnerabilities: fixed versions released (in Japanese) | ITmedia NEWS
- Prime Minister Takaichi’s unusual request on X (in Japanese) | ITmedia NEWS
- Advance notice of PHP security release (in Japanese) | IPA
- Usage Report of PHP broken down by Content Management Systems | W3Techs
Featured image: PHP logo by Colin Viebrock, licensed under CC BY-SA 4.0. Exported from the official SVG on php.net to a 1422×767 PNG without changing its shapes or colors; WordPress may resize or crop it for display. Its use does not imply endorsement by the PHP project.
