PHP Foundation discloses two critical vulnerabilities affecting all versions since 2004

Critical vulnerabilities affect two decades of PHP versions

The PHP Foundation announced two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting all PHP installations serving web requests from version 5 onwards. PHP 5 was released in July 2004 and remains in use across millions of systems, including major platforms like WordPress, Drupal, and Adobe’s Magento.

The vulnerabilities are rated 9.2 on the Common Vulnerability Scoring System (CVSS), indicating a severe risk of unauthenticated attackers executing arbitrary code or reading sensitive memory. Only PHP 8.2 and newer versions will receive official patches, while older versions may rely on third-party fixes or remain unpatched.

Early attacks and government responses

Cloudflare reported observing early attacks exploiting the vulnerabilities before the PHP Foundation released patches. Security experts anticipate mass exploitation within minutes of public disclosure.

Government websites in Finland, France, the Netherlands, Denmark, and Canada were taken offline as a precautionary measure. The Port of Rotterdam’s website and multiple Finnish government services, including the National Land Survey, were among those affected. The UK’s National Cyber Security Centre (NCSC), the European Union’s EU-CERT, and Australia’s cybersecurity agency issued warnings urging immediate system updates.

Brett Leatherman, Cyber Assistant Director at the FBI, advised organizations to monitor PHP systems for exploitation and report compromises to authorities like the FBI or CISA.

AI tools uncover longstanding flaws

AI tools played a pivotal role in discovering these vulnerabilities. Researchers at Wiz, OpenAI, and Calif independently identified the flaws using AI-assisted security scanning. Calif and OpenAI even reported the same root cause of one vulnerability on 11 August 2026.

The PHP Foundation has increasingly relied on AI tools like Anthropic’s Claude Mythos and OpenAI’s Daybreak to scan and validate security reports. Since July 2026, the Foundation has published 15 CVEs, working through over 100 invalid or duplicate reports.

Structural challenges in patching PHP

One of the critical flaws, part of the PHP2Shell vulnerabilities, was identified in 2024 but remained unpatched due to disagreements over fixes. The PHP Foundation described the delay as a structural failure caused by decision-making processes and resource constraints.

The flaws affect core PHP functions like memory management and error handling, making them difficult to address without trade-offs such as backward compatibility risks or changes to third-party extensions. The Foundation has since changed its security decision-making process from consensus to majority vote and established an Ecosystem Security Team in May 2026.

Leaks of the CVE identifiers and a proof-of-concept video on 20 October accelerated the disclosure process. Chainguard prematurely released built images of the fix, compromising coordinated disclosure efforts.

Funding and future priorities for the PHP Foundation

The PHP Foundation is seeking additional funding from companies, hosting providers, and governments to support its security work. Over the summer of 2026, the Foundation hired two more engineers to bolster its capacity, but structural challenges remain.

Tiffany Farriss, Interim CEO of the Drupal Association, noted that all PHP versions released in the last 20 years are vulnerable, underscoring the urgency of updates. Evan Solomon, Canada’s Minister of Artificial Intelligence and Digital Governance, confirmed that government systems in Canada were taken offline to prevent potential breaches.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

This incident reveals the fragility of critical internet infrastructure, particularly in open-source software like PHP, which underpins a significant portion of the web. For founders and operators, the implications are clear: unsupported or outdated software poses severe risks, and the consequences of delays in patching can be widespread and rapid. The role of AI in identifying these vulnerabilities also signals a shift in how security research is conducted, with AI-assisted tools becoming indispensable for uncovering deep-seated flaws.

For startups and enterprises relying on PHP, this is a wake-up call to audit their software stack and prioritize updates. The fact that only PHP 8.2 and newer will receive patches may force organizations to accelerate migrations or seek third-party support for older versions. Additionally, the PHP Foundation’s funding challenges highlight the broader issue of sustaining open-source projects that form the backbone of the internet. Companies benefiting from these projects may need to step up their contributions to ensure long-term security and stability.

Key takeaways

• Founders and operators using PHP must prioritize updating to PHP 8.2 or newer immediately, as no other mitigations exist. Older versions may remain exposed unless third-party vendors provide fixes.
• This incident underscores the risks of relying on unsupported software, even in critical internet infrastructure. It may accelerate migrations away from older PHP versions or prompt reconsideration of long-term maintenance strategies.
• The use of AI in discovering these vulnerabilities signals a shift in cybersecurity practices. Startups in this space should note the growing role of AI-assisted security tools for identifying and addressing deep-seated flaws.
• The widespread impact of these vulnerabilities—including government outages—highlights the urgency of coordinated disclosure and patching. Organizations must prepare for rapid response to similar incidents, particularly in widely used open-source software.

Related on Lazyfounder

• Cloudflare
• Wiz
• OpenAI
• Anthropic
• More technology news
• OpenAI’s GPT-6 improves COBOL and Fortran performance, but agents weaken safety monitoring
• Anthropic’s Cloud Challenges and Wealth-Sharing Plans Highlight AI Sector Risks
• OpenAI reports AI agents disabled safety monitoring and lied about it