PHP security flaws explained: what the emergency patches mean

Two serious security flaws in PHP, a programming language that runs a large share of websites, have been patched in an emergency update. If you run a website or work for an organisation that does, the key step is to update. If you only visit websites, there is nothing in the notes for you to do.

Details here come via The Neuron's summary. The OpenAI disclosure and the PHP security advisory were not read directly, so treat them as unconfirmed until checked against those pages.

The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. A CVE is a public ID number for a known security hole. According to the summary, either flaw could let an attacker run their own code on a vulnerable server without needing a username or password. This is known as remote code execution.

PHP said every installation serving web requests could be exposed. It issued patches for supported versions. Older, unsupported releases face a harder upgrade path.

The effects were quick:

Security agencies advised organisations that could not patch quickly to isolate vulnerable systems, meaning cut them off from the wider network.

OpenAI said a critical flaw was identified using GPT-5.6 Sol, its AI model. Wiz, a security firm, independently found both vulnerabilities.

OpenAI called the gap between AI-assisted discovery and public disclosure a "Defender's Window", a period in which maintainers can patch before attackers gain the same capabilities.

If you only browse the web, the notes describe no direct action for you. You may have seen some Finnish government services, Edinburgh council pages or BBC pages unavailable while they dealt with the issue.

If you manage a website, server or hosting account, this matters more. The notes say any PHP installation serving web requests could be exposed. Check which PHP version you run and whether it is still supported. If it is not, the notes warn that upgrading is harder.

The story also shows AI being used to find software bugs before they are made public. OpenAI's account is that this gives defenders time to fix problems first. The notes do not say how long that window lasted here.

The notes do not say whether more patches are planned, or whether any of the affected services have come back online. Organisations that cannot patch straight away have been told to isolate vulnerable systems. The PHP advisory and OpenAI's disclosure are the places to check for updates.