Two critical PHP flaws dating to 2004 put 70% of websites at risk, NSA warns

NSA advises patch now or go offline

The U.S. National Security Agency warned on Wednesday that two critical vulnerabilities in PHP put a huge portion of the web at risk, and that any site which cannot be patched immediately should be taken offline until it can be, according to TechCrunch. The agency's guidance was blunt: an unpatched, internet-facing PHP server is a worse option than no server at all.

PHP is a server-side language used so widely for web applications that it runs roughly 70% of the websites on the internet — more than 33 million sites by some counts — and it underpins major content management systems such as WordPress. TechCrunch reports that the flaws let an attacker break into the server's file system or into a database the web application relies on.

Bugs that have shipped since 2004

The vulnerabilities have been sitting in every PHP release since version 5, which arrived in 2004, TechCrunch reports. That lineage creates a patching problem: PHP 8.1 and older branches no longer receive support, so sites running them have no fixed release to upgrade within. They must move to a current version, which TechCrunch identifies as 8.5.12.

The two issues have been assigned the identifiers CVE-2026-109618 and CVE-2026-109619, and they affect PHP installations that serve web requests, including setups running PHP-FPM and mod_php, according to a post on dev.to. The same post lists the first patched release on each supported branch: 8.2.35 for PHP 8.2, 8.3.36 for 8.3, 8.4.27 for 8.4, and 8.5.12 for 8.5.

AI found the flaws, and lowered the bar for attackers

What makes the discovery notable is how the bugs surfaced. According to TechCrunch, security testing firm Calif, working as part of OpenAI's "Patch the Planet" effort to find flaws in open-source software, uncovered one of the vulnerabilities using GPT-5.6 Sol, as OpenAI disclosed in a blog post. Separately, Google's Wiz used its Wiz Atlas security agent along with Gemini 4 Argon and GPT-5.6 Sol to find multiple vulnerabilities in PHP.

Both organisations coordinated with the PHP project on patches before public disclosure, and worked together to compare findings and test the fixes, TechCrunch reports. Wiz credited Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft and Vercel for their help. WordPress issued a statement saying the flaw is not specific to its platform, but that sites running its CMS still need to patch their servers and confirm with their hosting companies that they are protected.

There were no reports of exploitation in the wild at disclosure time, and OpenAI says researchers reached the bugs before criminals did. The historical reason, per TechCrunch, is that the flaws were previously too difficult for attackers to weaponise in practice. Wiz cautioned that this barrier has now fallen, since language models can help adapt an exploit to a target's specific PHP version, configuration and memory layout. In other words, AI is both the reason the bugs were found early and the reason they now carry elevated risk.

Verifying a site is actually patched

The dev.to post offers a caution for anyone checking exposure from the outside: remote signals can only tell you so much. A CDN response or a PHP version header cannot confirm that the origin server behind it is patched. If an external check comes back inconclusive, the post advises asking the hosting provider which PHP package serves the live site and whether it includes fixes for both CVEs.

Why it matters

Two flaws that have shipped with essentially every PHP deployment for two decades are now public knowledge, and the difficulty that once protected them has been removed by the same class of AI tooling that found them. The result is a race between the operators of tens of millions of sites applying updates and attackers adapting exploits with AI assistance. For teams running PHP, the practical checklist is short: identify which PHP branch and package serves each site, update to the fixed release for that branch or migrate off unsupported versions, verify that the origin — not just a CDN edge — is patched, and follow the NSA's guidance to take unpatchable systems offline until they are fixed.