Why are PHP security vulnerabilities trending?
A series of severe vulnerabilities in the PHP programming language, which powers roughly 70% of websites, were recently uncovered. The flaws could allow hackers to steal data or seize control of web servers, leading many organizations to preemptively shut down services to apply patches.
What happened
- Earlier
Flaws in the PHP codebase exist for over a decade, but remained hidden due to the complexity required to exploit them [3].
- 21 Oct, 2026
PHP releases a patch to fix multiple memory-safety vulnerabilities in its core engine [3].
- 22 Oct, 2026
Millions of attempts to exploit the flaw are detected; the UK government takes 32 services offline as a precaution [1], [2].
What you need to know
The vulnerability, called PHP2Shell, affects nearly every version of PHP released in the last 10 years, including version 5.4 [3].
Frontier AI models were used to discover these flaws by simplifying the complex steps needed to create an exploit [3].
The flaw is independent of the specific website application, meaning even secure sites are at risk if the underlying PHP engine is unpatched [3].
Some older systems may be incompatible with the patch and will require full replacement [2].
It is not yet confirmed if any successful hacks have occurred, though experts warn the full impact may take months to surface [1], [2].
Background
PHP is a back-end programming language developed in the early 1990s. It collects data on a server and turns it into readable web pages [1].
Because it is used by major platforms like WordPress, Wikipedia, and Drupal, it serves as a foundational piece of infrastructure for a vast portion of the internet [1], [3].
Questions people ask
What can an attacker do with this flaw?
Attackers could potentially execute remote code, steal sensitive data like API keys and passwords, or deface websites [3].
Which websites are affected?
Any site using PHP is potentially at risk, including those powered by WordPress, Joomla, and MediaWiki [3].
Where this came from
[1] bbc.com
Race to update services' computer systems after cyber-security flaw found
Preview image from bbc.com
[2] theguardian.com
Websites across world hit by millions of attempts to exploit PHP code flaw
Preview image from theguardian.com
[3] wiz.io
PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
Preview image from wiz.io
Found through Google Trends and drafted with AI from at least two cited sources. Published automatically after passing our automated checks for sources, wording and safety. It may not have been reviewed by a person yet. Report a correction.