Cybersecurity organisations and governments across the globe called on businesses and organisations to quickly patch their PHP applications after researchers found two flaws that could potentially enable attackers to compromise their servers and steal data, Al Jazeera reported.
The bugs led to some government sites in Europe and elsewhere to shut down on Wednesday as administrators rushed to install security fixes Reuters reported.
The US National Security Agency, FBI, and Cybersecurity and Infrastructure Security Agency urged organisations to mitigate the vulnerability immediately. In Britain, the National Cyber Security Centre recommended affected organisations to patch their systems or disconnect them temporarily.
The two flaws, dubbed CVE-2026-109618 and CVE-2026-109619, could be exploited by remote, unauthenticated attackers to run malicious code remotely, which could lead to sensitive data and databases being exposed, according to the European Union Agency for Cybersecurity.
PHP is a very popular language that enables websites and apps (e.g. WordPress, Drupal) to run.
The vulnerability were detected with the use of artificial intelligence tools, the two firms said. OpenAI and a third-party cybersecurity company, Wiz, said on Wednesday that the PHP developers have issued security updates and advised users to apply them now.
The event has also sparked new fears that AI could hasten the discovery of software flaws and help researchers and hackers find security weaknesses.
