Critical vulnerabilities were found in PHP, the programming language powering WordPress, Drupal, Joomla, Magento, and roughly 75% of the web on October 21, 2026. The flaws were discovered by AI tools at Wiz and Calif after lying hidden in PHP’s code for over 20 years. About 1.5 million servers out of 2.6 million detected are running unpatched versions. Government websites across Europe, Wikipedia, and the Internet Archive went offline as a precaution. Exploitation was already happening in the wild before the patch went public.
What PHP Actually Is and Why This Matters So Much
PHP is a programming language that dates back to the early 1990s, it originally stood for “Personal Home Page.” It’s the code that runs on a web server and assembles the content visitors see when they load a page. It’s free, open-source, and maintained by volunteers.
It also underpins a remarkable share of the public web. WordPress runs on PHP. So do Drupal, Joomla, and Magento. According to web technology tracker W3Techs, PHP runs approximately 75% of websites whose programming language can be identified.
That scale is why Tiffany Farriss, interim chief executive of the Drupal Association, used the words she used when this vulnerability went public. “All servers using any version of PHP released in the last 20 years will be vulnerable. This issue impacts the majority of the internet.”
If that sounds dramatic, it isn’t. This is the kind of critical flaw where patching is measured in hours, not days. And where a slow response means you’re handing attackers a key to your server while they already have the map.
How AI Found a Flaw That Humans Missed for Over a Decade
The vulnerability wasn’t found through a security audit. It wasn’t discovered by a researcher manually reading PHP’s source code. It was found by AI.
Two cybersecurity firms published independent reports. Calif, a security company, said it found the flaws using a large language model on August 1 and had been working with the PHP team on a fix ever since. Wiz, a cybersecurity firm owned by Alphabet (Google’s parent company), said it independently discovered the same flaws using its autonomous AI tool Wiz Atlas, alongside Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol.
Wiz’s post included a specific observation that captures the moment we’re in. The vulnerabilities “would have been extraordinarily complicated for a human hacker to take advantage of.” Then: “Pre-AI, this manual work would be difficult to implement and even harder to scale. With AI, this is no longer a barrier.”
This is exactly the problem that AI-powered threat research has been flagging throughout 2026 , the same tools that help defenders find vulnerabilities help attackers exploit them. The flip side of AI discovering a PHP flaw is AI being used to develop exploits for that flaw the moment the patch details go public.
Costin Raiu, co-founder of cybersecurity research firm TLP:Black, named it directly. He said AI was powering a “race to exploit.” His assessment of where that race leads: “the mass compromise of every vulnerable web server on the internet.”
Amazon’s Honeypot Got Hit Before the Patch Was Even Public
Amazon security chief CJ Moses disclosed something particularly alarming on Wednesday night. Amazon’s security team had detected an attempt to exploit these vulnerabilities against one of its “honeypot” systems, fake servers designed to attract and document attack attempts, on October 17, four days before the public patch was released.
The attempt came from an anonymous IP address, suggesting an organised threat actor. More attempts followed from multiple actors on Wednesday itself, once the embargo lifted. Amazon said the flaws were now “being broadly exploited in the wild.”
The obvious question is how an attacker knew about the vulnerability before the patch was public.
That question was still unanswered as of reporting.The White House confirmed it had been made aware of the flaw on Friday , the same day as the Amazon honeypot hit Whether these timelines are connected is unclear.
Europe Pulled the Plug on Thousands of Websites
The practical response from government agencies across Europe was swift: if you can’t patch immediately, go offline. .The reasoning is straightforward a website that isn’t running can’t be exploited,
In the Netherlands, the response was extensive. The Dutch National Cyber Security Centre took its own website offline first, setting the tone. The Port of Rotterdam followed. So did the government portal Overheid.nl, the national soccer association KNVB, websites for the country’s five largest political parties, and several hospital websites.
The Dutch prime minister said he was closely monitoring the situation.
In Denmark, municipal IT company Kombit shut down several services, including the national school communication platform , meaning students and parents lost access to daily school communications while servers were patched.
Finland’s state IT services provider Valtori took government public network services offline “as a precautionary measure.” France’s Interior Ministry placed all of its websites into preventive maintenance.
Wikipedia took down an unspecified number of systems. The Internet Archive, the non-profit digital library that preserves web history, briefly went offline entirely to deal with the issue.
Japanese Prime Minister Sanae Takaichi posted on X urging website owners to “check whether your live site uses PHP and prepare to apply the new fix.”
The Scale of the Unpatched Problem
Censys, an internet intelligence firm, provided the numbers: approximately 1.5 million out of 2.6 million detected hosts are running versions of PHP for which no fix yet exists. That’s a massive pool of vulnerable servers.
Not all of them are high-value targets. But enough of them are. Small businesses running WordPress on shared hosting, local government agencies, hospital networks, educational institutions , exactly the kind of organisations that supply chain and software vulnerability attacks prioritise because they patch slowly.
Automattic, which operates WordPress.com and Tumblr, confirmed that users of its hosted services were safe from this bug. The risk is highest for self-hosted PHP deployments , the people running their own servers who have to manually apply patches. On shared hosting, the situation is particularly complicated, because customers don’t directly manage the underlying server and depend entirely on their hosting provider to act.
Lukasz Olejnik, a visiting senior research fellow at King’s College London, put the combined risk plainly: “The scale is huge, and with AI, exploitation may happen instantly.”
What You Should Do Right Now
If you run any website or server using PHP, the action is unambiguous. The PHP team has released patches and is urging all users to update immediately. Go to php.net to find the current stable releases.
If you can’t patch immediately, consider taking your site offline until you can. That’s the calculation governments across Europe made this week: a temporarily offline website does less damage than a compromised server.
If you use a managed WordPress host like WordPress.com, WP Engine, or Kinsta, check with your provider about their patching status. Many managed hosts will patch at the infrastructure level without requiring you to act, but you should confirm rather than assume.
If you run a self-hosted WordPress, Drupal, Joomla, or Magento installation, patching the underlying PHP version is separate from updating the CMS itself. Both need to be current. For businesses whose customer or user data sits behind a PHP-powered application which describes most of the web, the risk isn’t just website defacement., A compromised PHP server can expose databases containing personal information. If your site handles customer data, GDPR and state privacy regulations require prompt notification when a breach occurs. Our guide on what to do when personal data is exposed covers what happens after a breach, but patching now is how you avoid that conversation entirely.
The Sonora government portal credential exposure we covered earlier this year showed exactly how a misconfigured PHP-based system leads to credentials ending up on underground forums. A mass exploitation wave of unpatched PHP servers would produce that outcome at a scale that dwarfs individual incidents.
Frequently Asked Questions
What is the PHP vulnerability?
Critical security flaws found in all versions of PHP released in the last 20 years, discovered by AI tools at Wiz and Calif. Details are being withheld while patching continues, but exploitation is already active.
Who is at risk?
Any self-hosted website running PHP including WordPress, Drupal, Joomla, and Magento installations. Managed hosting platforms like WordPress.com have patched their infrastructure.
Were sites actually exploited before the patch?
Yes. Amazon detected an exploitation attempt against a honeypot server on October 17, four days before the patch went public.
What should I do?
Update PHP immediately via php.net. If you can’t patch right now, take the site offline until you can.
