The discovery of two critical security vulnerabilities in PHP has triggered an international effort to protect websites and government systems, exposing a funding gap at the nonprofit organisation responsible for supporting one of the internet’s most widely used programming languages.
The PHP Foundation has just one full-time employee, Executive Director Elizabeth Barron, and relies on 14 mostly part-time contractors, unpaid board members, donations and grants. That limited structure supports a programming language that may underpin as many as 70% of websites worldwide, highlighting the dependence of internet infrastructure on open-source projects with limited resources.
The vulnerabilities, which had remained undetected for about a decade, prompted emergency software updates on October 21. Cloudflare reported millions of attempted exploits following public disclosure, while government agencies and businesses moved to patch vulnerable systems or temporarily restrict access to online services.
Barron told Reuters that the foundation had no evidence that attackers had successfully exploited the flaws before disclosure or compromised systems that had been patched. The distinction is important: a surge in attempted attacks does not, by itself, establish that the vulnerabilities resulted in successful breaches.
Critical Flaws Put Global Websites on Alert
The two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, were rated critical by the PHP security team. Under certain conditions, they could allow attackers to execute malicious code on vulnerable servers without first authenticating themselves.
The PHP project released fixes for supported branches, including PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The foundation urged users to update immediately, while cybersecurity agencies advised organisations to identify affected systems, prioritise internet-facing infrastructure and monitor for suspicious activity.
The scale of the response demonstrated how a flaw in a single open-source component can create risks across a wide range of online services.
Cloudflare Chief Executive Matthew Prince said the company observed thousands of attempts to exploit the vulnerabilities in the hours before their public announcement, followed by tens of thousands within 45 minutes, hundreds of thousands within two hours and millions thereafter.
Government websites in Europe and elsewhere went offline as administrators worked to secure their systems. Japanese lender Mitsubishi UFJ Financial Group temporarily suspended some internet services, while Japan’s government urged website operators to check their use of PHP and prepare to apply the fixes.
The US National Security Agency also urged organisations to identify vulnerable services and install the relevant updates. The European Union’s cybersecurity agencies issued a joint warning calling for immediate action.
The response illustrates the risks associated with widely deployed software components. A vulnerability in a common programming language can affect many independent applications, organisations and hosting environments, even when those systems have different owners and security teams.
AI Helps Find Flaws but Increases the Workload
Artificial intelligence played a role in identifying the PHP vulnerabilities, demonstrating its potential to help researchers uncover weaknesses that traditional review processes may miss.
OpenAI said it had worked with maintainers, researchers and cybersecurity providers through its Patch the Planet initiative to identify and address critical vulnerabilities. The company said Calif identified one critical flaw using GPT-5.6 Sol, while cybersecurity firm Wiz independently discovered and reported both vulnerabilities. PHP maintainers led the work to develop and release fixes.
The discoveries also underline a growing challenge for open-source software developers: AI can accelerate the production of code and the discovery of defects, but the resulting changes still require careful human review.
Barron told Reuters that the PHP project was receiving nearly twice as many proposed code changes as a year earlier, even though the number of contributors had not doubled.
Reviewing code submissions and bug reports requires substantial human input and experience, she said. An increase in submissions can therefore create a larger maintenance burden without a corresponding increase in the number of people available to assess the changes.
For a project that supports a large share of the web, this creates a difficult balance. AI tools can help developers identify vulnerabilities and work more efficiently, but maintainers must still determine whether proposed changes are correct, secure and compatible with existing software.
The latest incident also highlights the difference between finding a vulnerability and maintaining the infrastructure needed to respond to it. Researchers may identify a flaw quickly, but coordinated disclosure, testing, patch development and communication with users require sustained resources.
The PHP Foundation works with external researchers and companies, including OpenAI and cybersecurity firms Wiz and Calif, to investigate security problems and coordinate responses. Such partnerships can bring additional expertise to the project, but they do not eliminate the need for long-term funding and experienced maintainers.
Barron said the recent events had demonstrated how heavily companies and governments rely on PHP. Given that dependence, she argued, the foundation was severely underfunded.
The challenge extends beyond PHP. Open-source software is used throughout the technology industry, from web servers and databases to cloud infrastructure and security tools. Its code can be freely used and adapted, but the work needed to maintain it securely still requires people, expertise and money.
The PHP crisis has brought that imbalance into sharp focus. As AI accelerates both software development and vulnerability discovery, the security of widely used digital infrastructure will depend not only on better tools but also on whether the projects responsible for maintaining it receive adequate support.
FAQs
1. What are the latest PHP security vulnerabilities?
Two critical vulnerabilities discovered in PHP prompted an international effort to secure websites and servers. The flaws had reportedly existed for about a decade, and the PHP project released security updates to address them.
2. Why are the PHP vulnerabilities a global concern?
PHP is widely used to build and operate websites, and may underpin up to 70% of websites worldwide. A serious vulnerability can expose numerous applications and servers, making prompt patching essential.
3. Has the PHP security flaw been exploited by hackers?
Cloudflare reported millions of attempted exploits following public disclosure. However, PHP Foundation Executive Director Elizabeth Barron told Reuters that the foundation had no evidence of successful exploitation before disclosure or on systems that had been patched.
4. How is artificial intelligence affecting PHP security?
AI has helped researchers identify vulnerabilities, potentially accelerating security research. However, it has also increased the volume of proposed code changes and bug reports, adding to the workload of maintainers who must review submissions for accuracy and security.
5. What should website owners do to protect their websites?
Website owners should identify the PHP versions running on their servers, install the relevant security updates, check whether hosting providers have applied patches and monitor systems for suspicious activity. Unsupported PHP versions may require additional mitigation or migration to a supported release.
6. What does the PHP security incident reveal about open-source software?
The incident highlights the gap between the widespread use of open-source software and the resources available to maintain it. Even when major companies and governments depend on a project, its security can rely on a small group of developers and limited funding.