Urgent security fix issued for code vital to estimated 70% of all websites
Urgent security fix issued for code vital to estimated 70% of all websites
Wed, October 21, 2026 at 6:36 PM UTC
0
Stock Photo/Getty Images - PHOTO: A computer screen with programming code in an undated stock photo.
PHP may not be a household name, but the programming language, released over 30 years ago, powers a large share of websites and web applications. Nearly 70% of the internet is estimated to use PHP, including WordPress, which is used for more than 40% of websites.
Now the PHP development team is urging users to update immediately after fixing two critical vulnerabilities, rated 9.2 out of 10 in terms of danger, that if exploited could allow attackers to take over internet servers.
On Wednesday, the PHP development team released updates that "fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately,” according to the official PHP website.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday said it "strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP," noting that while it "has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched."
Likewise, the FBI Cyber Division urged all potentially affected organizations to "immediately update affected PHP installations."
"If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated," the FBI said.
The U.K. government's National Cyber Security Centre also encouraged organizations "to prepare for immediate updating of systems using PHP. Where immediate remediation is not feasible, organizations should consider taking the system offline until it can be fully mitigated.”
FTC opens probe into safety of AI, including Anthropic and OpenAI
Open AI posted Wednesday morning that their AI models helped researchers discover the PHP flaws.
Advertisement
"Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure," the post said, in part. "Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact."
The company added that they believe their AI model identified the problems before hackers could exploit the vulnerabilities.
STOCK PHOTO/Getty Images - PHOTO: Fiber Optic cables and UTP Network cables in an undated stock photo.
OpenAI has come under increased scrutiny in recent months following disclosures that their AI models attacked numerous websites, including U.S. government websites and those of rival AI companies.
In an online post later Wednesday, the PHP Foundation said "a potential exploit" for the code problem was theorized as early as 2024, "but no concrete vectors were found and other concrete issues with clear impact overshadowed these concerns.” Work on the fix continued sporadically over the ensuing years due to relevant experts being "occupied with many responsibilities," which in turn "caused work on a fix to stall and restart repeatedly over months.”
The PHP Foundation says it entered the PHP project into OpenAI's Patch the Planet program and a security audit began in July. In September, OpenAI identified ways the vulnerabilities could be exploited, according to the PHP Foundation, which said that information – and additional reports from a security researcher and the website provider Wiz – convinced them that fixing the issue needed to be “top priority” and they began that work on August 11.
OpenAI says its AI agents disabled their own monitoring
Once the vulnerabilities "began circulating on online forums and social media" in recent days, the PHP development team decided to push forward its planned announcement and fix, the post said.
"We won't pretend otherwise: the delay was a structural failure," the post added.
Before the PHP fix was released, the cybersecurity firm watchTowr said Tuesday it believed the vulnerabilities "could let attackers run their own code on affected servers" and that "organizations running PHP in production should prepare to update quickly once an official fix is released.”
The PHP team said updating the code is the only complete fix. While it lists temporary measures to address the vulnerabilities, such as adjusting memory and upload settings, it notes that those measures only reduce exposure and do not make a server safe from potential exploitation.
Source: “AOL General News”
