PHP, short for Hypertext Preprocessor, is an open-source scripting language that powers roughly 70% of websites and apps that use a known server-side programming language. We are talking about millions of websites and web applications, from high-traffic platforms like Wikipedia to those built with content management systems such as WordPress, Joomla, Drupal and Magento, as well as frameworks like Laravel.
On 21 October 2026, two critical security vulnerabilities were disclosed in PHP. These vulnerabilities could allow hackers to execute malicious code remotely on vulnerable servers without even logging in. The worrying part is that the flaws are in PHP’s core engine, not necessarily in the applications built with it. That means your website’s code could be perfectly secure, yet the underlying PHP installation could still leave your server exposed.
NSA & NCSC on PHP Security Vulnerabilities
The threat is serious enough that some organisations in Europe and elsewhere temporarily took websites offline to address the vulnerabilities. The US National Security Agency (NSA), the UK’s National Cyber Security Centre (NCSC), and other cybersecurity authorities continue to urge organisations to install the fixes immediately.
Researchers discovered both flaws using AI, raising concerns that hackers could also use the same technology to exploit them. If successful, these attacks could permit unauthorised code execution, steal sensitive information, tamper with files or compromise affected systems.
PHP Vulnerability Fix: Patched PHP Version
Fortunately, the PHP project has since released security updates to address both flaws. Organisations running supported versions can protect their systems immediately by upgrading to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. However, those running older, unsupported deployments may need to migrate to one of these modern releases, as PHP 8.1 and earlier versions have reached End of Life and do not receive security updates.
AI Effect on Cybersecurity
Historically, weaponising a massive, complex security flaw to hack a website required a deep understanding of cybersecurity, memory management, and software engineering, but AI is changing that. We are getting to a point where someone with just a laptop and a capable Large Language Model (LLM) could point an autonomous agent at websites across the internet and command it to launch attacks until it uncovers a vulnerability.
And you might be thinking, “Claude and ChatGPT aren’t gonna let me do this,” but there are plenty of open-source models that people can run on their own hardware to do stuff like this.
Should we say the barrier to executing sophisticated cyberattacks is falling super-fast, and websites aren’t getting any more secure?
Written by Isaac Odwako.
