PHP, short for Hypertext Preprocessor, is an open-source scripting language that powers roughly 70% of websites and apps that use a known server-side programming language. We are talking millions of websites and web applications, from high-traffic platforms like Wikipedia to those built with content management systems such as WordPress, Joomla, Drupal and Magento, as well as frameworks like Laravel.
On 21 October 2026, researchers using AI discovered two critical security vulnerabilities in PHP. The team behind the disclosure said that attackers could exploit these vulnerable servers remotely without even logging in.
The worrying part is that the flaws are in PHP’s core engine, not necessarily in the applications built with it. That means your website’s code could be perfectly secure, yet the underlying PHP installation could still leave your server exposed. These attacks can allow unauthorised code execution, steal sensitive information, tamper with files or compromise affected systems.
NSA & NCSC on PHP Security Vulnerabilities
The threat is serious enough that some organisations in Europe and elsewhere temporarily took websites offline to address the vulnerabilities. The US National Security Agency (NSA), the UK’s National Cyber Security Centre (NCSC), and other cybersecurity authorities globally have continued to caution organisations about the dangers of this imminent threat.
PHP Vulnerability Fix: Patched PHP Version
Fortunately, the PHP project has since released security updates to address both flaws. Organisations running supported versions can protect their systems immediately by upgrading to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. However, those running older, unsupported deployments may need to migrate to one of these modern releases, as PHP 8.1 and earlier versions have reached End of Life and do not receive security updates.
If your website runs on a CMS (like WordPress) or uses shared hosting, contact your hosting provider to confirm PHP has been patched. If you manage your own VPS or dedicated server, update PHP to a patched version immediately.
AI Effect on Cybersecurity
Historically, weaponising a massive, complex security flaw of this magnitude to hack a website required a deep understanding of cybersecurity, memory management, and software engineering, but AI is changing that. We are getting to a point where someone with just a laptop and a capable Large Language Model (LLM) could point an autonomous agent at websites across the internet and command it to launch attacks until it uncovers a vulnerability.
And you might be thinking, “Claude and ChatGPT aren’t gonna let me do this,” but there are plenty of open-source models that people can run on their own hardware to do stuff like this.
Should we say the barrier to executing sophisticated cyberattacks is falling super-fast, and websites aren’t getting any more secure?
Written by Isaac Odwako.
