Federal agencies told organizations to update PHP immediately or take sites offline, a warning that reaches from state and city portals to the San Francisco companies that run much of the web’s publishing infrastructure.
By Staff Reporter
Federal cybersecurity officials on Wednesday urged every organization that runs PHP, the programming language underneath most of the world’s websites, to install an emergency update at once, and to take their sites offline if they could not, after researchers disclosed two critical flaws that could let an attacker seize control of a web server without a password.
The warning, issued by the Cybersecurity and Infrastructure Security Agency, the National Security Agency and the F.B.I., set off a day of precautionary shutdowns around the world. Wikipedia’s parent organization, the San Francisco-based Wikimedia Foundation, took down several systems, according to The Guardian and the BBC. Government sites in the Netherlands, Finland and elsewhere in Europe went dark while they were patched.
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed “php2shell,” were found with the help of artificial intelligence, according to the researchers and to OpenAI, whose models were used in the work.
What the agencies said
CISA said the vulnerabilities “allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests.” It told organizations to move immediately to PHP versions 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and said systems that cannot be updated right away, or that still run version 8.1 or older, which no longer receive support, “should take PHP-based systems offline until they can be patched or updated.”
The agency also cautioned that PHP “is often a component of other software” and that its presence “may not be directly observable,” meaning some organizations may not know they are exposed. As of publication of its alert, CISA said, it had “not observed exploitation of these vulnerabilities.”
Others reported earlier activity. Amazon said it had been targeted in multiple attempts days before the public disclosure, the BBC reported. Cloudflare, the San Francisco internet infrastructure company, wrote in a technical post that details leaked before the official release and that “we observed attack traffic targeting our customers.”
The N.S.A. said the risks were “serious enough to require immediate patching across United States Government departments and agencies,” according to the BBC, and warned that the flaw could “provide a direct path to the server’s file system or database,” as quoted by The Guardian.
How the flaws were found
The security firms Wiz and Calif found the problems. In a detailed account, Wiz said nearly every PHP version released in the last decade, going back to version 5.4, is affected by at least one of the bugs, which it said ranked “among the most severe vulnerabilities discovered in PHP, and arguably in software history.” The firm said it had demonstrated takeovers of sites running WordPress, Drupal and Joomla before any login, though it stressed that the vulnerable code sits in PHP itself rather than in any one application.
The underlying weaknesses, in how PHP handles out-of-memory errors, had existed for years, Wiz wrote, but turning them into a working attack “required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve.” Frontier A.I. models, it said, “substantially reduced that barrier.”
OpenAI, based in San Francisco, called the discovery “one of the most impactful security issues in recent memory,” according to The Verge, and said in a blog post, as quoted by the BBC, that the episode “highlights how AI can uncover security flaws” while also showing how it can “help attackers rapidly develop offensive tools and exploits.”
Why it matters in California
PHP runs about 70 percent of websites whose server software can be identified, according to figures cited by Wiz and by Nextgov/FCW. That reach extends to the public sites Californians use for city services, school portals, small businesses and nonprofits, many of which run on WordPress or similar software maintained by small staffs.
Nextgov reported that an analysis using the Shodan search engine found roughly 900 results tied to federal, state and local government websites showing signs of PHP use, many listing older versions, though it noted those records might not reflect recent updates.
The disruption reached Bay Area institutions directly. California College of the Arts in San Francisco took several services offline on Wednesday while it applied the patch; most were restored by noon Pacific time, but the college said it had no timeline for its Moodle course system.
The episode also highlights how much of the web’s plumbing is managed from San Francisco. Automattic, the company behind WordPress.com, said on X that sites hosted on WordPress.com, WordPress VIP, Pressable, Tumblr and its other infrastructure were “already protected.” Wiz credited Automattic, Akamai and Amazon Web Services, among others, with preparing mitigations for customers who could not patch immediately. (The Inquirer is published on WordPress.com.)
A longer tail
Security researchers said the hardest part may come in the weeks ahead. Alan Woodward, a cybersecurity expert at the University of Surrey, told The Guardian that “there is going to be a long tail of websites who may not be maintained as well,” which “means we may see weeks and months of ongoing attacks.”
Salil Kanhere, a researcher at UNSW Sydney, told the BBC that more attempts to exploit the flaws are likely now that technical details are public, and warned users to be alert to phishing messages that trade on the news.
For most readers, the agencies’ advice is directed at website operators rather than visitors. The BBC reported that users should watch for notices from services they use, such as requests to reset passwords. For the many California cities, school districts and small businesses that maintain their own servers, the guidance from Washington was blunt: identify every system running PHP, update it, and if that is not possible, take it offline.
