Critical PHP flaws put millions of websites at risk as exploit attempts emerge

Hackers are exploiting newly disclosed PHP vulnerabilities that could let attackers take control of enterprise web servers without a password, putting millions of websites and applications at risk.

Disclosed on October 21, the two critical flaws affect PHP, the programming language behind platforms including WordPress, Drupal and Joomla. Researchers at security company Wiz demonstrated how attackers could remotely execute commands or steal sensitive information. The researchers used Google’s Gemini 4 Argon, OpenAI’s GPT-5.6 Sol and Wiz’s own AI agent, Atlas, to help identify the vulnerabilities, chain the bugs together and test and debug their approach until they developed a working exploit. Palo Alto Networks’ Unit 42 has since reported attacks in the wild, raising the urgency for businesses still running vulnerable systems.

“Critical PHP flaws may let attackers run commands without signing in. Patch now; isolate what cannot be fixed,” Mark Hughes, Global Managing Partner for Security Services at IBM Consulting, told IBM Think in an interview.

The vulnerabilities are especially dangerous because they affect the underlying PHP software rather than individual websites.

“PHP processes web requests before WordPress, Drupal, Laravel or other application code runs,” Hughes said. “All PHP systems serving web traffic need review.”

Palo Alto Networks identified more than 22.6 million publicly exposed instances that may be vulnerable to the flaws, although that figure does not represent confirmed infections.

The bugs, identified as CVE-2026-109618 and CVE-2026-109619, involve errors in how PHP manages memory. Attackers could exploit them to run malicious code without valid credentials.

AI-powered cyberattacks are becoming a growing problem for businesses. According toIBM’s 2026 Cost of a Data Breach Report, AI-driven attacks increased 56% over the previous year, as criminals increasingly used AI-generated impersonations and malware to target organizations.

IBM Senior Vice President Rob Thomas warned on LinkedIn that AI is accelerating the discovery and exploitation of security flaws, leaving companies less time to respond. He pointed to IBM and Red Hat’s Lightwell, which combines AI with human expertise to fix vulnerabilities in open-source software without requiring major upgrades.

For enterprises, the challenge is identifying vulnerable PHP installations across websites, cloud services, containers and older infrastructure.

Hughes warned that Apache mod_php, a configuration running PHP inside the Apache web server, presents particularly serious risks.

The PHP project released security updates in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Organizations should patch immediately, verify that updated software is running and isolate systems that cannot be fixed.

Security teams should also investigate suspicious activity, including unexpected commands and outbound connections.

“It’s serious,” Hughes said. “Organizations need to act now. But they need to be systematic and get the patching done.”