New PHP Website Security Alert: What Happened and What to Do Now

On October 21st, the Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent alert about two critical vulnerabilities in PHP, technology used to run WordPress and many other websites. These flaws could allow attackers to run malicious code on an affected web server without logging in. Read CISA’s alert.

Before we dive into what happened, here’s how to protect your business.

Uprise recommends contacting your website developer or hosting provider immediately to confirm whether your website uses PHP and that any required security patches are in place. You do not need to make technical changes yourself—ask your provider to complete the five steps below.

Five steps to take now

1. Check your exposure. Identify websites and applications using PHP, including customer portals, internal tools, and older sites. Confirm who is responsible for updating each one
2. Update the underlying software. PHP released fixes in versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Your provider should confirm that the appropriate release—or a verified equivalent or later patch—is installed. Updating WordPress or plugins alone does not fix PHP. Older, unsupported versions require particular attention. See PHP’s advisory.
3. Verify the fix is active. Confirm that every affected system is running the patched software, including any necessary restarts. Then test essential functions such as logins, forms, and payments.
4. Reduce exposure if there is a delay. Ask whether access should be restricted or an affected service temporarily taken offline. Firewall protections may help, but they do not replace the update.
5. Check for suspicious activity. Review activity records and unexpected system changes. Patching closes the vulnerability; it does not remove an attacker who may already have gained access. See CISA’s guidance on detecting suspicious activity.

What exactly is PHP, and why does it matter?

When someone visits your website, they see pages, images, and information. Behind the scenes, software processes their requests—loading content, checking login details, handling forms, and retrieving information.

PHP is one of the programming languages used to do that work. It runs on a server and helps generate what visitors see and interact with. Even if you have never heard of PHP, your business may depend on it.

On October 21, 2026, OpenAI announced that researchers at security firm Calif had identified a critical PHP security flaw with help from one of its AI models. Another research team, Wiz, independently discovered and reported that flaw and a second related vulnerability. PHP’s developers released security updates to address both. Read OpenAI’s announcement.

What happened—and what did AI have to do with it?

AI helped researchers identify the problem. It did not create the underlying vulnerability. OpenAI says Calif used its GPT-5.6 Sol model during the research, and PHP’s developers led the work to fix the software.

The researchers found two weaknesses in how PHP manages the temporary information it uses while processing website requests.

Normally, PHP handles that information in an orderly way: it receives a request, processes the necessary data, and clears information that is no longer needed. These flaws can disrupt that process, potentially allowing an attacker to make the server run unauthorized instructions.

The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. These identifiers are reference numbers that help technology providers find the correct security information and updates. Both flaws received a critical severity rating of 9.2 out of 10. Read Google Cloud’s explanation.

Why is this dangerous?

The most serious concern is that an attacker could potentially send a specially designed request to a vulnerable website and make the server execute their instructions without needing a username or password.

In the security business, we call this unauthenticated remote code execution. In plain language, it means someone outside your organization could potentially make your web server do things it should not.

The flaws can also expose sensitive information held temporarily in the server’s memory. Researchers have demonstrated successful attacks against systems using PHP, including WordPress, Drupal, and Joomla—popular platforms for building and managing websites.

Using one of these platforms does not mean your website has been breached. It does mean your technology provider should check the PHP software underneath it. Read the researchers’ findings.

What could happen to an affected business?

The consequences depend on what the affected system can access and how it is protected. Potential impacts include:

• Exposed information: Attackers could access customer details, business records, or credentials available to the application.
• Unauthorized changes: Website content or application data could be altered.
• Malicious software: Criminals could install software that supports continued access or further attacks.
• Service interruptions: Websites, portals, or online transactions could become unavailable.
• Additional security incidents: Exposed credentials or connections could give attackers a route toward other systems.

While these are possible outcomes, this is more than a theoretical concern. Amazon Threat Intelligence reported attempts to exploit these flaws against its monitoring systems before public disclosure, followed by broader exploitation afterward. That makes prompt action—and checking for evidence of unauthorized activity—important. Read Amazon’s findings.

How Uprise Partners can help

For many organizations, the challenge is knowing which systems are affected, who owns the response, and whether the work is complete.

Uprise Partners helps our clients assess potential exposure, prioritize affected systems, and coordinate with website developers, hosting companies, and application providers. We help confirm that patches are in place, review relevant security alerts, and determine whether further investigation is needed.

If you’re looking for an IT and cybersecurity partner to help your organization strengthen its defenses and navigate issues like these, connect with Uprise Partners. We’d love to start a conversation!