Governments, banks, airlines and major technology companies are racing to secure their systems after two critical flaws were discovered in PHP, the programming language behind almost 70 per cent of websites. Artificial intelligence helped researchers identify the vulnerabilities, while Cloudflare reports millions of attempted attacks. Australia’s cybersecurity authorities are urging organisations to update their software immediately.
A major cybersecurity emergency is unfolding across the internet as governments, financial institutions and technology companies scramble to protect their websites from two critical vulnerabilities in PHP, one of the world’s most widely used programming languages.
The flaws, identified as CVE-2026-109618 and CVE-2026-109619, could allow attackers to remotely execute malicious code on vulnerable servers without needing a username or password.
The discovery has triggered an international security response, with some organisations temporarily shutting down websites and online services while technical teams install emergency updates.
According to internet infrastructure company Cloudflare, the number of attempts to exploit the vulnerabilities increased dramatically following their public disclosure, reaching millions within hours.
The scale of the threat is particularly concerning because PHP is used by almost 70 per cent of websites for which the server-side programming language is known, including systems supporting businesses, government services, online retailers and publishing platforms.
The vulnerabilities were discovered with the assistance of advanced artificial intelligence systems and security researchers, highlighting both the growing power of AI in cybersecurity and the risks associated with weaknesses hidden inside software used worldwide.
Millions of hacking attempts detected within hours
Cloudflare chief executive Matthew Prince revealed the extraordinary speed at which suspicious activity increased after details of the vulnerabilities became public.
During the ten hours preceding the official disclosure, the company’s global network recorded thousands of attempts to exploit the flaws.
Within 45 minutes of the announcement, that number had climbed to tens of thousands.
After two hours, Cloudflare was detecting hundreds of thousands of attempts.
The total subsequently reached millions.
The rapid increase demonstrates how quickly cybercriminals can respond when serious vulnerabilities become publicly known.
However, the number of attempted attacks does not necessarily represent the number of successful intrusions.
Security companies distinguish between malicious requests directed at vulnerable systems and confirmed cases in which attackers have actually compromised a server.
Cloudflare has deployed emergency protections through its web application firewall infrastructure, helping customers identify and block suspicious requests.
The company has nevertheless stressed that firewall protection is not a substitute for installing the official PHP security updates.
Why PHP matters to almost the entire internet
PHP is a server-side programming language that has played a central role in the development of the modern internet for more than three decades.
Unlike the visual elements that users see when they visit a website, PHP operates behind the scenes, processing information, communicating with databases and generating web pages.
It is widely used by content management systems, online stores, forums and business applications.
Among the best-known platforms relying on PHP are WordPress, Drupal, Joomla and Magento.
These systems support millions of websites worldwide, from small personal blogs to major commercial and institutional services.
The problem is particularly serious because the newly discovered vulnerabilities affect the underlying PHP software itself, rather than a specific website plugin or application.
That means a website could be exposed even when its own code has been carefully maintained and its plugins are up to date.
The vulnerabilities potentially affect installations using PHP versions dating back to 5.4, including many systems that have remained operational for years without major software upgrades.
Security experts warn that older applications and websites running unsupported software may face particular difficulties because they cannot always be updated without substantial technical changes.
Two critical vulnerabilities with a severity rating of 9.2
The PHP development team has classified both flaws as critical, assigning each a severity score of 9.2 under the Common Vulnerability Scoring System (CVSS) version 4.0.
The vulnerabilities involve weaknesses in the way PHP manages computer memory and processes certain internal operations.
Under specific circumstances, an attacker may be able to manipulate these weaknesses by sending specially constructed requests to an affected server.
Successful exploitation could potentially allow unauthorised access to sensitive information, interference with website operations or the execution of malicious programs.
In particularly serious cases, attackers could gain control over affected services.
Researchers have also demonstrated the possibility of exposing information held temporarily in server memory, including passwords, authentication tokens and other sensitive data.
The two vulnerabilities are collectively being referred to as PHP2Shell, a name reflecting their potential to provide attackers with access to vulnerable servers.
The seriousness of the flaws lies not simply in their technical complexity but in their location within software that forms part of the infrastructure of an enormous number of websites.
Artificial intelligence helped uncover vulnerabilities hidden for years
One of the most significant aspects of the discovery is the role played by artificial intelligence.
Researchers from cybersecurity company Wiz, working alongside other specialists, used advanced AI models to identify and investigate weaknesses that had remained undetected for many years.
Google Cloud confirmed that its Gemini technology contributed to the research, including vulnerability identification, testing and verification of security fixes.
The wider coordinated research effort also involved organisations including OpenAI, Calif.io and Quarkslab.
According to the researchers, identifying the underlying software errors was only one part of the challenge.
Understanding how the vulnerabilities could be exploited required extensive analysis of PHP’s internal memory management and the interaction between different components of the software.
AI-assisted tools helped accelerate that work, allowing researchers to investigate complex combinations of weaknesses that would otherwise have required substantial manual analysis.
The discovery highlights the increasingly important role of artificial intelligence in defensive cybersecurity.
Advanced systems can assist researchers in analysing large codebases, identifying unusual behaviour and testing whether proposed fixes are effective.
At the same time, experts warn that similar capabilities may also be used by malicious actors to accelerate attacks against vulnerable systems.
The resulting challenge is a technological race between those developing better defences and those attempting to exploit weaknesses before they are repaired.
Emergency website shutdowns from Japan to Europe
The disclosure has caused widespread disruption as organisations take precautions to prevent possible security breaches.
In Japan, major companies and public institutions temporarily suspended some online services while assessing their exposure.
Among the organisations taking precautionary measures were financial institutions Nomura and Mitsubishi UFJ Financial Group, airline All Nippon Airways and East Japan Railway.
Several Japanese government bodies also temporarily restricted access to online services, including parts of the Ministry of Finance, the Meteorological Agency and the National Tax Agency.
European organisations adopted similar measures.
French telecommunications company Orange temporarily suspended access to certain PHP-based websites and applications across some subsidiaries.
In Finland, government IT services provider Valtori restricted public web services while technical teams installed security updates.
The organisation subsequently began restoring access, warning that some services could require extensive testing before reopening.
Importantly, Finland’s precautionary shutdowns were not reported as the result of a confirmed successful cyberattack.
They were preventive measures intended to reduce exposure while the affected systems were secured.
The distinction is important: temporary service interruptions do not automatically mean that customer information has been stolen or that a network has been compromised.
Australia issues urgent cybersecurity warning
Australia has joined the international response through the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC).
The agency published a critical security alert warning organisations about the two vulnerabilities and urging administrators to identify affected PHP installations.
The advisory applies to businesses, government agencies, website operators and other organisations running PHP-based services.
The ACSC recommended that technical teams examine their systems, follow official PHP security guidance and apply the relevant updates.
It also advised organisations to monitor websites and supporting infrastructure for unusual activity that could indicate attempted exploitation.
Australia’s warning initially stated that the agency was not aware of confirmed active exploitation at the time of publication.
Subsequent reporting from international cybersecurity companies, however, documented a sharp rise in malicious attempts following public disclosure.
The situation illustrates how rapidly cybersecurity intelligence can change during an international incident.
For Australian businesses, the vulnerabilities are particularly relevant because many websites, online stores and digital publishing platforms rely on PHP.
An organisation does not need to operate a large technology department to be exposed.
Small businesses, community organisations and independent website publishers may also use vulnerable software through their hosting providers or website management systems.
Critical updates released: website operators urged to act
The PHP development team has released emergency updates addressing the vulnerabilities.
The patched versions are:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Website administrators are being urged to install the appropriate supported version as soon as possible.
The PHP security team has made clear that there is no complete alternative to applying the official fixes.
Firewalls, traffic filtering and monitoring tools may help reduce exposure, but they cannot guarantee that an unpatched installation is secure.
Organisations using older PHP versions face additional challenges.
Some unsupported versions no longer receive regular security updates directly from the PHP project, meaning operators may need to migrate to newer software or obtain verified security fixes from their operating-system vendors.
Technical teams must also ensure that updated PHP services are properly restarted and that the patched software is actually running.
Simply downloading an update is not enough if the active website continues using an older version.
Security experts recommend that operators work with their hosting providers or qualified technical personnel to complete the process safely.
WordPress websites are among those requiring attention
The incident has particular implications for the large number of websites built using WordPress.
The publishing platform relies on PHP, meaning that the security of its underlying server environment is essential.
A website running the latest WordPress version may still be vulnerable if the PHP software installed on its server has not been updated.
This distinction is especially important for publishers and businesses that regularly update plugins and themes but rarely check the software running behind their websites.
Organisations using managed hosting services should contact their provider to confirm that the emergency PHP updates have been installed.
Self-hosted websites may require direct intervention by the system administrator.
Site owners should also ensure that backups are available and that unusual activity is investigated promptly.
The discovery does not mean that every WordPress website has been hacked.
It means that websites running affected PHP versions could be exposed until the appropriate security fixes are installed.
Microsoft chief executive warns of growing software complexity
The scale of the emergency has prompted comments from some of the technology industry’s most senior executives.
Microsoft chief executive Satya Nadella, speaking during an event in Germany, described the incident as unusually significant.
He said he had not witnessed anything comparable for a considerable period and acknowledged the extensive work undertaken by cybersecurity teams to respond.
Nadella also highlighted the importance of designing software that can be maintained securely as digital systems become increasingly complex.
His remarks reflect a broader problem confronting governments and businesses.
Many essential online services depend on software developed over decades, incorporating layers of updates, extensions and components that may be difficult to replace.
Even when serious vulnerabilities are identified and patches are made available, implementing changes across large and interconnected systems can take considerable time.
For major organisations, updates must often be tested carefully to ensure they do not disrupt essential services.
For smaller businesses, the problem may be a lack of technical resources or awareness of the software on which their websites depend.
The risks extend beyond website disruption
Although much of the immediate attention has focused on websites going offline, the potential consequences of a successful attack could be more serious.
Depending on the affected system and the circumstances of an intrusion, an attacker might gain access to confidential information, interfere with online services or attempt to compromise other connected systems.
Businesses handling customer records, online payments or sensitive communications may face additional risks if vulnerable servers are exposed.
However, the existence of a critical vulnerability does not establish that such incidents have occurred at any particular organisation.
Each suspected compromise requires independent investigation.
The immediate priority for website operators is to reduce exposure by applying patches and examining security logs for signs of attempted or successful exploitation.
Experts also recommend reviewing access controls and ensuring that recovery procedures are available if an incident occurs.
A warning about the foundations of the digital economy
The PHP security emergency demonstrates how much of the global economy depends on shared software infrastructure.
Banks, airlines, retailers, media organisations and government departments may appear to operate entirely different digital systems, yet many rely on the same underlying technologies.
A vulnerability discovered in one widely used component can therefore create an international problem almost immediately.
The incident also raises questions about the resources available to maintain open-source software.
Many essential programming languages and software libraries have been developed and supported over decades through the work of relatively small groups of programmers, researchers and contributors.
Their work supports a vast digital economy, but the complexity and scale of the systems involved continue to increase.
Artificial intelligence may provide new tools for identifying weaknesses earlier and improving the effectiveness of security research.
At the same time, the speed with which attempted attacks followed the disclosure illustrates why organisations cannot rely solely on the discovery of vulnerabilities.
They must also be prepared to respond quickly when updates become available.
The lesson from the PHP emergency is clear: maintaining cybersecurity is not a one-time investment, but a continuous responsibility shared by software developers, hosting companies, governments and website operators.
As security teams continue applying patches and monitoring suspicious activity, the event serves as a reminder of the vulnerabilities hidden within technologies that millions of people use every day without ever knowing they exist.
For businesses and individuals responsible for websites, the most important action is immediate: verify the PHP version in use, confirm that the appropriate security update has been applied and seek technical assistance where necessary.