PHP Vulnerability: Why Governments Have Issued a Security Warning

The Indian Computer Emergency Response Team (CERT-In), India's cybersecurity agency, has issued a warning about a vulnerability in PHP, a programming language that runs a large part of the internet. The flaw is serious. Hackers could exploit it to take control of websites and servers, potentially gaining access to sensitive information.

CERT-In has classified the threat as high risk and asked organisations and individuals using affected versions of PHP to install security updates immediately. US’ National Security Agency (NSA) has also issued a similar warning. But its advice is more drastic: organisations that cannot fix the vulnerability should take affected systems offline.

The concern is understandable. PHP is not some obscure software used by a small group of developers. It runs millions of websites, including some of the internet’s most familiar platforms. A weakness can therefore have consequences well beyond the website where it is first exploited.

Here is what the warning is about and what it means for internet users.

What is PHP?

PHP stands for PHP: Hypertext Preprocessor. It is an open-source programming language used mainly to build and run websites. Put simply, it allows websites to carry out tasks other than displaying text and pictures.

For example, when a user opens a website, it has to fetch the latest articles, arrange headlines, load images and perhaps display content based on the reader’s preferences. PHP helps make this happen. It processes information on the server before the finished page appears on the user’s screen. Login systems, online forms, comment sections and shopping platforms often rely on PHP while website-building platforms such as WordPress also use it.

That is what makes the vulnerability concerning. A flaw in PHP could affect websites across different industries and countries, even if those websites have little in common.

The Vulnerability

CERT-In has flagged two critical vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619. They have been given the name PHP2Shell.

Basically, a software vulnerability is a weakness that someone can exploit to make a programme do something it was not designed to. In the present case, an attacker could use the flaws to run their own code on a vulnerable server, also called remote code execution (RCE). It is a dangerous kind of attack because the hacker does not need physical access to the computer or an existing account to access the system.

All they may need is an internet connection and a specially crafted request sent to the vulnerable server. If the attack succeeds, they can run malicious instructions on it. The attacker could then steal information, disrupt a website or use the compromised system to launch attacks on other networks.

How Was It Discovered?

Given the day and age, the answer to this question seems obvious: artificial intelligence (AI).

Researchers at Wiz and cybersecurity firm Calif used AI tools to examine PHP’s underlying code, leading them to identify weaknesses that had gone unnoticed for years. But these were not obvious errors; they were complex interactions that made it difficult to spot through the normal methods.

According to Wiz, AI helped its researchers establish how the weaknesses—which existed for over a decade, as per the company—could be turned into actual exploits. Wiz and Calif worked alongside the PHP development team and OpenAI. Once the flaws were identified, the researchers helped PHP’s developers prepare fixes before publicly disclosing their findings.

The incident shows how AI is changing cybersecurity research. Researchers can use AI to test whether a weakness can be exploited. But then, the same capabilities could be used by hackers to exploit such weaknesses. The concern is that the gap between discovering a vulnerability and seeing it used in an attack could shrink.

Why Are Governments Concerned?

PHP is used widely—Wiz puts the figure at 70 per cent of all websites—and this is why cybersecurity agencies are worried.

To put it simply, a flaw in one website might affect its users and owners. But a flaw in the programming language itself can have much wider consequences.

The warning has prompted alerts from several governments and cybersecurity agencies. CERT-In in India and the NSA have issued advisories, warning that attackers could send specially designed requests to vulnerable systems, take control of servers, steal sensitive information or disrupt services. Other governments, including those of the UK, Canada and Australia, have also issued warnings through their national cybersecurity agencies, urging organisations to identify vulnerable systems and install security updates.

The message is largely the same: identify affected systems and install the security patches without delay.

The Solution

The PHP development team has released patches to address the issue, namely PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and advised those using the older releases to upgrade.

An update is essential. Just restarting a website or changing its password will not address the underlying flaw. Administrators must also restart the relevant PHP services after installing the update to ensure the patched version is running.

The PHP development team has said that updating is the only complete solution to the vulnerabilities.

However, ordinary users need not panic or stop visiting websites that run on PHP as they don’t need to install or upgrade anything. The onus rests with the organisations running these websites and the companies providing their hosting and software services.

The incident, though, exposes a weakness in how the internet works. A website may appear to be a single, finished product to its visitors. Behind the scenes, it depends on programming languages, databases, servers and several third-party tools. If one of these has a serious vulnerability, the consequences can spread across the system.