LONDON - The PHP project released emergency security updates Wednesday for two critical vulnerabilities that could allow an unauthenticated attacker to execute code on web servers, setting off a rapid patching effort across governments, businesses and the vast number of services built on the widely used programming language.

The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP security team said every installation serving web requests may be exposed, including systems using PHP-FPM, Apache's mod_php, php-cgi, FrankenPHP and LiteSpeed. It assessed the danger as highest for mod_php, where researchers demonstrated an attack that could be triggered before an application's own code begins running.

The first flaw, tracked as CVE-2026-109618, involves memory corruption after PHP encounters an out-of-memory condition while internal request data is only partly initialized. Cleanup code can then treat invalid data as legitimate. The second, CVE-2026-109619, can leave request-owned state in memory after the underlying allocation has been freed, allowing a later request handled by the same worker to use stale information.

Both weaknesses can lead to remote code execution, one of the most serious outcomes in cybersecurity because it can give an attacker the ability to run commands, steal data, install backdoors or move deeper into a network. No password is required for the demonstrated attack paths.

Britain's National Cyber Security Centre issued a critical alert urging organizations to identify every PHP system, prioritize internet-facing servers and install fixed packages. It said operators unable to update or apply temporary measures should consider taking affected systems offline and examine them for signs of compromise before returning them to service.

The PHP team stressed that its suggested mitigations reduce only particular attack paths and do not make an installation safe. Updating is the complete solution. PHP 8.1 and older versions are no longer supported by the project, although some Linux distributors and long-term-support vendors may provide backported fixes. The project also published minimal source backports for versions 7.4, 8.0 and 8.1 to help operators who cannot immediately move to a supported release.

The Associated Press reported that some public websites became unavailable while operators responded, including parts of Finland's government website. The FBI's cyber division warned that successful exploitation could expose sensitive data and connected networks. OpenAI said it had led a research coalition that worked with maintainers for two months to investigate and repair the vulnerabilities.

The hidden foundations of the internet need defenders

The emergency is a reminder that much of the modern web rests on infrastructure that ordinary users never see. PHP powers application back ends and is embedded in popular content-management and commerce systems. A weakness in the language can therefore reach far beyond developers who knowingly installed it, including appliances and hosted products that quietly bundle PHP as a component.

That scale makes patching difficult. Large technology companies can inventory servers and deploy updates quickly, but schools, local governments, hospitals and small businesses often run old systems with limited technical staff. Attackers know this. Once a public advisory identifies a severe flaw, defenders race to update while criminals race to reverse-engineer the patch and find machines that remain exposed.

The discovery also demonstrates the constructive value of American-led artificial-intelligence research when it is paired with responsible disclosure. Finding a dangerous weakness is only the beginning. Researchers must privately coordinate with maintainers, test repairs, alert major vendors and give defenders enough information to act without handing attackers a ready-made blueprint. That process took time, and secrecy during remediation was part of protecting the public.

Open-source maintainers carry an extraordinary burden in this system. Software used by millions of organizations can depend on relatively small teams, while hostile governments and criminal groups devote significant resources to finding a single mistake. Companies that profit from open-source foundations should contribute engineers, testing capacity and funding instead of treating community maintenance as free and unlimited labor.

Organizations also need to abandon the assumption that an application firewall or hidden server is adequate protection. The PHP advisory says the confirmed mod_php attack can occur before application code runs, meaning controls inside the application may never get a chance to intervene. Accurate asset inventories, supported software, fast deployment pipelines and network segmentation are basic requirements, not optional upgrades.

Administrators should install the fixed version supplied by their trusted operating-system or software vendor, restart affected workers and monitor logs and systems for unusual activity. They should also find devices and third-party products that contain PHP indirectly. A server that cannot be patched or isolated should not remain exposed merely because taking it offline is inconvenient.

The internet's resilience depends on thousands of unglamorous maintenance decisions made before an attacker arrives. This week's coordinated repair prevented a serious discovery from becoming an excuse for panic. The remaining danger is delay: every unpatched server now represents a known opportunity, and the window for responsible action is already open.