The NSA has told website owners that if they cannot patch PHP right now, they should take the site off the internet. That is an unusual thing to hear about a programming language most people have not thought about since their last WordPress install. It is also a fair summary of how seriously the two newly disclosed PHP flaws are being treated.
The twist is where they came from. Both were found with AI, and the same AI is the reason they are considered dangerous.
What was found
The PHP Foundation has issued patches for two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. Each is rated 9.2 out of 10 on the CVSS 4.0 scale. According to the reports, they let an attacker run arbitrary code on a server remotely. One account says they open the way into the server's file system or into a database the web application uses.
One report also says the bugs have been sitting in every version of PHP since version 5, released in 2004. Two decades is a long time for something this serious to go unnoticed, which makes the explanation below more interesting.
PHP is not a niche tool. By one estimate it runs roughly 70% of websites, and by some counts more than 33 million sites. It sits under popular content management systems, WordPress included. Hence the NSA's tone.
How AI found them
Two groups arrived at the flaws, partly separately.
- OpenAI's initiative. The security testing firm Calif took part in OpenAI's "Patch the Planet" effort to find flaws in open source software. Using GPT-5.6 Sol, it found one of the flaws, and OpenAI disclosed this in a blog post.
- Wiz's work. Separately, the Wiz team (Google's security arm) used AI to look for PHP bugs. Its toolkit included its Wiz Atlas security agent, Gemini 4 Argon and GPT-5.6 Sol. One report says this turned up multiple vulnerabilities, which sits slightly awkwardly beside the two headline CVEs. It is not clear from the sources how the extra findings map to the patched pair.
Both followed the usual responsible disclosure script. They worked with PHP on fixes before saying anything publicly, then pulled in a long list of helpers to flesh out the findings and test the patches. Wiz thanked Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft and Vercel.
OpenAI says researchers found the flaws before hackers did, and that there were no reports of exploitation in the wild at the time of the announcements.
The part where the good news has an asterisk
There is a reason these bugs survived since 2004. Before AI, they were reportedly too hard for attackers to exploit reliably. Wiz put it bluntly in its own write-up: with AI, that barrier is gone, because large language models can help adapt an exploit to different PHP versions, configurations and memory layouts.
So AI found the problem, AI made the problem serious, and AI is presumably available to the people who read the disclosure. It is a tidy loop, if not a comforting one.
The practical consequence is a race. The flaws are now public, so attackers know where to look, and tens of millions of sites need updating before they get around to it. The NSA's advice that an unpatchable site is better off offline is the logical result.
What to patch, and to what
The fixes landed in several release branches.
| Branch | Fixed version |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
One report names 8.5.12 as the current version and recommends moving to it. Linux distributions and long-term-support platforms are expected to ship their own updated packages, so many administrators will get the fix through their usual package manager rather than by hand.
PHP 8.1 and older are no longer supported, and anyone on them has more work to do. One report adds a nuance: the main project no longer issues regular updates for those branches, but separate fixes have been prepared for some of them. Check before assuming you are stranded, and check before assuming you are fine.
If an immediate update is impossible, the PHP developers have suggested temporary risk-reduction measures. They are explicit that these do not give full protection. Think of them as a seatbelt on a car you should not be driving yet.
What about WordPress
Because WordPress runs on PHP, there was some worry that this is a WordPress bug. WordPress has said it is not. The flaw is in the language runtime, not the CMS. Site owners need to patch their servers and work with their hosting companies to make sure the fix is applied. For anyone on managed hosting, that means asking the host, not poking at plugins.
Loose ends and conflicting signals
The reports do not line up perfectly, and a few points deserve caution.
- Exploitation status. OpenAI says there were no exploits in the wild when the flaws were disclosed. Another report notes earlier online chatter about a tool called PHP2Shell, which was claimed to allow arbitrary code execution on sites using popular CMSs and web frameworks. The sources do not connect it to these CVEs or confirm it works, so treat it as an unverified claim.
- Sites going dark in Europe. One report mentions that some government and other organizations in Europe temporarily took sites offline as a precaution. That is consistent with the NSA's advice, but the sources give no names or numbers.
- Scale in Russia. The head of the large language model development centre at MWS AI, Valentin Malykh, told the Russian press that tens of thousands of Runet resources could be at risk. That is one expert's estimate, not a measured count.
- Scope of the damage. One account describes access to the file system or database, another describes remote arbitrary code execution. These are probably two descriptions of the same ability, but the sources do not spell it out.
What to do this week
- Find your PHP version. If you do not know it, that is the first problem.
- Update to a fixed release. Use 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distribution's patched package.
- Escalate if you are on 8.1 or older. Look for backported fixes, and plan a proper upgrade.
- Ask your host. Especially if you run WordPress on managed hosting.
- Take it offline if you must. The NSA means it.
There is something faintly funny about the whole episode. For twenty years, the best defense of a critical bug was that exploiting it was tedious. Then the machines got patient, and found it first. Now everyone else has to be quicker than the machines, which is a harder deadline than any change-management calendar was built for.