The UK government has said it is working to identify any potential exposure in its online services following the discovery of critical PHP security flaws that affect a large share of the world’s websites. Governments and major companies, including Amazon, are racing to protect their systems before hackers can exploit the weaknesses, BBC News reports.
PHP is a programming language that runs behind the scenes on a large proportion of websites. The two flaws, identified by researchers as CVE-2026-109618 and CVE-2026-109619 and collectively known as “php2shell”, allow attackers to run their own code on a vulnerable server without needing a password.
What the vulnerabilities actually do
According to Palo Alto Networks Unit 42, the first flaw (CVE-2026-109618) arises from the way PHP handles running out of memory: a technical process called longjmp() leaves part of the server’s working memory in an uninitialised state, which an attacker can exploit to take control of the system. The second flaw (CVE-2026-109619) involves a similar mechanism leaving the server’s memory pointing to regions that have already been freed, again allowing arbitrary code to be run.
The US National Security Agency (NSA) warned that the vulnerabilities ‘often provide a direct path to the server’s file system or database’. Attackers could use them to ‘steal sensitive data, disrupt services, or move deeper into a network’, the NSA added. ‘These vulnerabilities are flaws in PHP itself, not in the hosted application or its configuration,’ the agency said.
Cyber-security firm Wiz has estimated that ‘roughly 70%’ of the internet is affected, though the BBC said it was unable to independently verify that figure. The flaws are understood to have gone undetected for at least a decade.
How the warning spread, and what happened next
The PHP Foundation had planned to release details of the discovery later in October alongside a complete fix, or “patch”. Details of the flaw were, however, leaked on social media on 21 October, before the planned announcement. Amazon’s security chief CJ Moses said the company identified a ‘PHP2Shell exploitation attempt’ on 17 October, in which an anonymous internet address tried to target weaknesses in one of Amazon’s decoy, or “honeypot”, systems. The use of an anonymous IP address, Moses said, suggested the activity was carried out by a ‘threat actor’. Amazon said it was unclear how those involved had known about the vulnerabilities before the embargo was lifted.
In further attacks on 21 October, Moses said, ‘the actual payloads and choices in anonymisation infrastructure varied, suggesting these were multiple actors.’ The use of AI in finding the flaw means that ‘more actors can act within hours or even minutes once technical details of a vulnerability are disclosed’, he added.
Anna-Maria Arabia, CEO of the Australian Council on AI Strategy, told the BBC that the PHP incident had ‘demonstrated how quickly AI is changing our cybersecurity landscape’, as ‘what used to take months, to expose a vulnerability, is now taking days’. She warned that such threats would only grow more common as AI technology improves. It is “not going backwards, in other words”, she said. OpenAI described the discovery as ‘one of the most impactful security issues in recent memory’.
Governments in the Netherlands and Finland took websites offline as a precaution, and Wikipedia also removed parts of its site, in line with advice issued by multiple governments. The UK’s National Cyber Security Centre (NCSC) urged organisations to apply the available fixes and said that ‘where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated’. A UK government spokesperson called on ‘all organisations, private and public, large and small’ to follow that guidance.
CISA, the US Cybersecurity and Infrastructure Security Agency, has urged organisations to update immediately to PHP versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to address the vulnerabilities. As of 21 October 2026, CISA said it had not at that point observed confirmed exploitation of the flaws, though Amazon’s reported incidents indicate active attempts were already under way.
