PHP
PHP released security fixes Oct 21, 2026 for CVE‑2026‑109618 and 109619 (PHP2Shell). Patches incorporated in PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. The flaws allowed unauthenticated remote code execution via unsafe out‑of‑memory cleanup and stale internal state reuse; Apache’s mod_php is the highest‑risk platform. Cloudflare logged widespread exploitation attempts; no confirmed successful breaches were reported by BSI or Japan’s government. PHP 8.1 and earlier no longer receive official releases, leaving older servers at risk unless upgraded. PHP Foundation coordinated the patch with Cloudflare, CISA, and the White House. PHP PATCHED CVE-2026-109618 PHP PATCHED CVE-2026-109619 mod_php RISKED_BY PHP GoDaddy WARNED PHP PHP is used by Magento European Union Computer Emergency Response Team warned about PHP vulnerabilities Huntress noted that fixes may only be for supported PHP 8 versions GoDaddy warned about the PHP vulnerabilities Wordfence noted that every WordPress site sits on a PHP server WordPress automatic updates do not fix the PHP vulnerabilities PHP Foundation scheduled a release for PHP vulnerabilities PHP Foundation scheduled its release at 14:00 UTC on 2026-10-21 ProgramBench includes tasks for building a PHP interpreter. Tomer Schwartz COLLABORATED_WITH PHP· Entity summary generated by Graphiti
Relation timeline
BY VALID-FROM DATE- Tomer SchwartzCOLLABORATED WITHPHP
Tomer Schwartz COLLABORATED_WITH PHP
- ProgramBenchINCLUDES TASK FORPHP
ProgramBench includes tasks for building a PHP interpreter.
- PHPHAS VULNERABILITYPHP2Shell
PHP has the vulnerability 'php2shell'
- PHP FoundationMAINTAINSPHP
PHP Foundation maintains PHP: Hypertext Preprocessor
- WizESTIMATED USAGE OFPHP
Wiz estimated that PHP powers about 70 percent of all websites in the world
- OpenAIWORKED WITHPHP
OpenAI worked with PHP to verify vulnerabilities and develop patches
- 4ChanTEMPORARILY SHUT DOWN DUE TOPHP
4Chan was temporarily shut down after the vulnerabilities were disclosed
- PHPPOWERSDrupal
PHP powers Drupal
- PHPPOWERSWordPress
PHP powers WordPress
- PHPPOWERSDeviantArt
PHP powers DeviantArt
- The Internet ArchiveEXPERIENCED OFFLINE DUE TOPHP
The Internet Archive was briefly forced offline because of PHP
- DeviantArtTEMPORARILY SHUT DOWN DUE TOPHP
DeviantArt was temporarily shut down after the vulnerabilities were disclosed
- PHPPOWERS4Chan
PHP powers 4Chan
- WizDESCRIBED VULNERABILITY OFPHP
Wiz has called the PHP vulnerabilities among the most severe discovered
- GPT-5.6 SolIDENTIFIEDPHP
GPT‑5.6 Sol was used to identify a critical PHP flaw
- PHPPOWEREDWikipedia
PHP platform powers Wikipedia
- PHP2ShellAFFECTSPHP
PHP2Shell vulnerability affects PHP core
- UK National Cyber Security CentreURGEDPHP
UK National Cyber Security Centre urged users of PHP to apply the fixes
- AustraliaURGEDPHP
Australia urged users of PHP to apply the fixes
- European UnionURGEDPHP
European Union urged users of PHP to apply the fixes
- WizIDENTIFIED VULNERABILITY INPHP
Wiz identified critical security vulnerabilities in PHP
- WikipediaBUILDS ONPHP
Wikipedia’s website is built on the PHP programming language
- WikipediaUSESPHP
Wikimedia uses the PHP programming language for its services
- WordPressBUILDS ONPHP
WordPress is built on the PHP programming language
- BBCHAD PAGES OFFLINE DUE TOPHP
BBC had pages offline due to PHP programming language
- MySQLDISCOVERED VULNERABILITIES INPHP
Wiz (cyber‑security firm) discovered vulnerabilities in PHP programming language
- Semantic Modeling LanguageURGEDPHP
UK National Cyber Security Centre urged on PHP programming language
- The TraitorsAFFECTED DUE TOPHP
The Traitors was affected due to PHP programming language
- Doctor WhoAFFECTED DUE TOPHP
Doctor Who was affected due to PHP programming language
- PhilippinesISSUED ADVICE ONPHP
United States National Security Agency issued advice on PHP programming language
- BNB FoundationADDRESSING VULNERABILITIES INPHP
Wikimedia Foundation addressed vulnerabilities in PHP programming language
- COBOLCLAIMEDPHP
Huntress (cyber‑security company) claimed PHP programming language is everywhere
- press592.phpDISCOVERED VULNERABILITIES INPHP
Calif (cyber‑security firm) discovered vulnerabilities in PHP programming language
- GitHubPROVIDES TOOL FORPHP
GitHub provides a tool to check PHP for the discovered vulnerability.
- PHPCOORDINATED WITHCloudflare
Cloudflare coordinated the fix with PHP developers.
- WizFOUND VULNERABLE INPHP
Wiz found the same PHP vulnerability.
- GPT-5.6 SolDISCOVERED VULNERABILITY INPHP
GPT-5.6 Sol discovered a critical PHP vulnerability affecting millions of websites.
- PHPCOORDINATED WITHWhite House
The White House coordinated the fix with PHP developers.
- PHPCOORDINATED WITHGoogle’s 100 ZEROS initiative
CISA coordinated the fix with PHP developers.
- PHPCOORDINATED WITHWiz
PHP developers and Wiz coordinated the fix.
Relations are facts Graphiti extracted from reports, not verbatim quotes. An end date means later reporting showed the relation no longer holds.
Events 10
- The ‘Vulnpocalypse’ is coming for the internet’s aging code, says Wiz’s CTO1 cited report · 2026-10-29
- Import AI 478: Math for alignment; ProgramBench; and Mirendil shows what RSI means1 cited report · 2026-10-26
- UK to invest £100m in 'world first' AI Biosecurity Lab1 cited report · 2026-10-24
- Is the Internet Safe Again After the PHP Nightmare? What You Need to Know1 cited report · 2026-10-23
- Race to update services' computer systems after cyber-security flaw found1 cited report · 2026-10-23
- Hackers got a four-day head start on epic PHP2Shell vulnerability1 cited report · 2026-10-22
- AI discovered a massive cyber-security flaw - here's what happened1 cited report · 2026-10-22
- [AINews] OpenAI’s Patch the Planet program is 1 of 2 parties to discover PHP2Shell vulnerabilities in core PHP affecting 70% of the web, using GPT-5.6 Sol; coordinated response over 2 months6 cited reports · 2026-10-22
- Governments working to identify exposure after global cyber-security warning3 cited reports · 2026-10-22
- OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon found critical PHP flaw affecting millions of websites2 cited reports · 2026-10-22
Source reports 19
- The ‘Vulnpocalypse’ is coming for the internet’s aging code, says Wiz’s CTOTechCrunch · AI · 2026-10-29
- Import AI 478: Math for alignment; ProgramBench; and Mirendil shows what RSI meansImport AI · 2026-10-26
- UK to invest £100m in 'world first' AI Biosecurity LabBBC Politics · 2026-10-24
- Is the Internet Safe Again After the PHP Nightmare? What You Need to KnowDecrypt · 2026-10-23
- Race to update services' computer systems after cyber-security flaw foundBBC World · 2026-10-23
- Hackers got a four-day head start on epic PHP2Shell vulnerabilityArs Technica · AI · 2026-10-22
- PHP: The three little letters wreaking havoc across the webThe Verge · AI · 2026-10-22
- AI discovered a massive cyber-security flaw - here's what happenedBBC World · 2026-10-22
- [AINews] OpenAI’s Patch the Planet program is 1 of 2 parties to discover PHP2Shell vulnerabilities in core PHP affecting 70% of the web, using GPT-5.6 Sol; coordinated response over 2 monthsLatent Space · 2026-10-22
- Governments working to identify exposure after global cyber-security warningBBC World · 2026-10-22
- What is PHP and why did it spark a global cyber-security scramble?BBC World · 2026-10-22
- Crypto Exchange Warning: Critical PHP Flaw Puts Payment Sites at RiskBeInCrypto · 2026-10-22
- Websites taken down worldwide as critical cyber-security update issuedBBC Business · 2026-10-22
- OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon found critical PHP flaw affecting millions of websitesThe Decoder · 2026-10-22
- Today's PHP Security Release, and How We're Strengthening PHP SecuritySimon Willison · 2026-10-22
- PHP Armageddon: OpenAI, Google’s Wiz find ancient holes, panicking the internetTechCrunch · AI · 2026-10-22
- Crypto security chiefs sound alarm as PHP emergency patch scrambles devs worldwideCryptoSlate · 2026-10-22
- PHP Panic: Two Critical Bugs Put 70% of the Internet at Risk, and Everyone Is Freaking OutDecrypt · 2026-10-21
- Why the EU Is Telling Some Websites to Switch Themselves OffBeInCrypto · 2026-10-21