Most people have never heard of PHP, but the programming language is a key component of about 70% of websites whose server-side programming language is known — and two critical vulnerabilities have put unpatched systems at risk after technical details circulated prematurely on Tuesday.
The scope of the risk is staggering. According to VirusTotal, an online cybersecurity service that helps assess whether files, websites, domains, and IP addresses are associated with malware or other threats, 5.1 million IP addresses run PHP, including about 758,000 running end-of-life versions.
"These aren't confirmed vulnerable systems, but the numbers highlight the potential scale of exposure, especially for older versions that may never receive official patches," software security firm Echo wrote in a LinkedIn post.
The risk of hackers exploiting the vulnerabilities to take over websites is so high that the NSA recommends organizations using PHP take affected systems offline if an immediate update is not feasible, and Finland, the Netherlands and France have reportedly begun unplugging their government sites.
Patches for the two PHP vulnerabilities — CVE-2026-109618 and CVE-2026-109619 — were released Wednesday. Echo explained that the release had been scheduled for Oct. 22, but technical information appeared on the Hacker News website on Oct. 20. Screenshots began circulating online, and a video demonstrating how to exploit the vulnerabilities was posted but quickly taken down, it added.
"Two critical remote code execution flaws in PHP, both rated 9.2, are about as serious as it gets for the web," Echo CEO and Co-Founder Eylam Milner told TechNewsWorld.
This is what happens when AI turns up a flaw that's been hiding for years, he noted.
"Something nobody was worried about yesterday became an emergency overnight," he said. "In this case, exploitation details were circulating before defenders had patches available, so attackers had a head start."
"The PHP team has done a good job in a horrible situation," he added. "The problem for most companies is they don't know where they're running PHP. It's in base images and in components that bundle their own runtime, and a lot of it is on versions older than 8.2 that are past end of life."
Madelein van der Hout, a senior analyst at Forrester Research , a national technology research company headquartered in Cambridge, Mass., explained that what makes these vulnerabilities significant is where they sit.
"PHP underpins websites and applications across many organizations and their suppliers, so checking the corporate website alone is not enough," she told TechNewsWorld. "Organizations need to establish where they are exposed and prioritize internet-facing systems."
She supported disconnecting websites to address the problem. "Taking a website offline does not mean it has been hacked," she said. "Where an organization cannot yet patch or adequately protect a potentially vulnerable system, temporarily taking it offline can be a proportionate risk decision — accept a short loss of availability rather than risk a potentially much more serious compromise."
She also advised organizations that a critical vulnerability, an attempted attack and a successful compromise are three different things. "Organizations should respond urgently to potential exposure without treating every vulnerable or offline website as evidence of a breach," she said. "That distinction matters, particularly while the situation is still…