WARNING: Internet Backbone Exposed

Skull silhouette in blue computer code background. — Photo: Shutterstock

A flaw sitting inside the code that runs most of the internet just got an emergency fix, and security officials are not calling it optional.

Quick Take

The PHP programming language team released patches for two critical bugs that could let hackers run code on websites without logging in.
PHP powers an estimated 70% of websites, including those built on WordPress, according to ABC News.
The National Security Agency and FBI urged organizations to update immediately or take systems offline if they could not patch right away.
News of the flaw reportedly leaked two days before the official fix was ready, adding pressure on defenders.

What The PHP Team Actually Announced

The PHP development team posted an update this week warning of two critical vulnerabilities. Their own statement, quoted by ABC News, said the fixes address bugs that “can allow unauthenticated remote code execution” and urged “all PHP users” to update immediately. That phrase, unauthenticated remote code execution, means an attacker does not need a password or login to take control. They just need a vulnerable, unpatched server sitting online.

Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially… pic.twitter.com/tnwiQv5v0F

— FBI Cyber Division (@FBICyberDiv) October 21, 2026

Researchers at Google’s Wiz Research, working with a research partner called Calif, described the problem as existing in PHP itself. It is not tied to one app or plugin. The flaw involves memory disclosure and code execution “independent of the application running on top of it,” according to their findings. That distinction matters because it means the danger is not confined to one type of website. Anything built on PHP, from small blogs to major platforms, shares the same underlying risk.

Why The Government Is Not Waiting Around

Federal cybersecurity voices did not treat this as a routine software update. The NSA reportedly told organizations running PHP to prepare for the patch, and recommended taking systems offline entirely if they could not update right away. The FBI echoed that same urgency. An advisory from the American Hospital Association, dated October 21, 2026, laid out a tight and troubling timeline. News of the vulnerability leaked on October 19, a full two days before the official patch became available.

That gap, two days of public awareness without a fix, is the kind of window security teams dread. It gives attackers a head start while defenders have nothing yet to install. Researchers tracking the bug, which some reports nicknamed PHP2Shell, said hackers could use it to seize control of websites, disrupt services, or pull sensitive data without ever needing valid credentials.

Putting The 70% Number In Context

The headline statistic driving coverage is striking: PHP reportedly runs on close to 70% of the web, and WordPress alone, which is built on PHP, makes up more than 40% of all websites. Independent measurement from W3Techs backs up the scale, putting PHP’s share of identifiable server-side languages at around 64.5% among top-ranked sites. Either way, the installed base is enormous.

That scale number describes how widely PHP is used, not how many sites are sitting open to this exact attack today. Version data shows a meaningful share of sites still run older PHP branches, meaning real-world exposure varies site by site depending on which version is installed and how exposed it is. The patch’s importance does not depend on a precise exposure count; it depends on how fast site operators act.

The Human Side: Slow Patching Has A Track Record

History is not encouraging on how quickly organizations move once a fix is public. Academic research tracking vulnerability disclosures found the average patching time across two major vulnerability databases ran into hundreds of days, not hours. PHP sits inside countless third-party apps, hosting platforms, and sites nobody actively maintains anymore, which means some installations may never get patched at all.

That lag is exactly why officials pushed so hard, so fast, this time. A maintainer releasing a fix is only half the job. The other half depends on millions of individual website owners, many without dedicated security teams, actually applying it. Until that happens broadly, the warning from PHP’s own team stands: update immediately, because the risk is not hypothetical, it is already public.

For everyday internet users, the practical advice is simple. Businesses and site operators running PHP should check their version now and apply the update without delay. The scale of PHP’s reach is exactly why a flaw like this draws federal attention instead of staying a quiet technical footnote.