Researchers Find Major PHP Programming Vulnerabilities
New security flaws in the PHP language allow unauthorized server access, prompting an urgent global patching effort.
Updated on Oct. 23, 2026 in Cybersecurity
Live Poll
Do you trust that major software companies are doing enough to secure the internet's older code?
Security researchers recently identified two vulnerabilities in the PHP programming language that could permit unauthorized server access. Millions of web servers are impacted by the flaws, which allow memory access when a process crashes.
Why it matters
The vulnerabilities stem from code that has remained largely unexamined since the 1990s, highlighting how AI tools now make it easier to discover deep-seated software bugs. This discovery has forced government and commercial entities worldwide to take websites offline as a protective measure.
The vulnerabilities reside in the code handling crash events, where memory data becomes accessible to subsequent requests. Affected users are required to update their systems to PHP versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
The players
Wiz
This cloud security company specializes in identifying complex vulnerabilities using advanced AI-driven analysis.
Cloudflare
This global web infrastructure company provides security services and observed millions of attack attempts following the disclosure.
CERT-In
This national agency is responsible for responding to computer security incidents and issued a critical advisory regarding the vulnerabilities.
Amazon
This global technology company detected early exploitation attempts and manages significant cloud infrastructure impacted by the flaw.
The details
Cloudflare observed millions of attack attempts shortly after the public disclosure, while Amazon detected exploitation efforts as early as October 17, 2026. The flaws, collectively referred to as PHP2Shell, were identified by researchers at Wiz using AI models.
Timeline
August 2026: Calif identified the first PHP vulnerability.
October 17, 2026: Amazon detected attempts to exploit the flaw.
October 22, 2026: Details leaked and PHP released a security patch.
October 23, 2026: Public disclosure occurred and CERT-In issued an advisory.
The Tech Race
The PHP programming language has been a foundation of web infrastructure since its inception in the early 1990s. This incident highlights the ongoing arms race between security researchers using AI to find legacy code bugs and malicious actors seeking to exploit them.
Website administrators and developers must immediately update their servers to the latest patched versions to prevent potential data exposure. Failure to apply these updates leaves servers vulnerable to unauthorized access and potential control by malicious entities.
The takeaway
Legacy codebases require periodic auditing as AI tools lower the barrier for identifying security vulnerabilities. Organizations should prioritize updating to the latest software versions to mitigate risks associated with long-standing architectural flaws.
Further reading
For more information on current digital threats, visit the Cybersecurity section.
Source note: This article includes information reported by Economic Times.
Live Poll
Do you trust that major software companies are doing enough to secure the internet's older code?
