PHP Flaws: Nine Security Firms Report No Successful Attacks a Day After Patches

7.6 · 10d ago · WORLD · TECH

The Facts

  • PHP maintainers released patches on Wednesday for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. ✓4 · DW, BBC, NBC News, TechCrunch
  • The vulnerabilities reportedly affect all PHP versions dating back to PHP 5, released in 2004. ✓3 · Ars Technica, BBC, TechCrunch
  • The flaws could allow remote attackers to take control of websites and servers without authentication. ✓2 · DW, BBC
  • The flaws were found in August by security firms Calif and Wiz using AI tools; Calif used OpenAI's GPT-5.6 Sol under OpenAI's 'Patch the Planet' initiative. ✓2 · DW, TechCrunch
  • Pinboard and parts of Wikipedia were temporarily down; the Wikimedia Foundation said it took down systems as a precaution until they can be patched. ✓2 · NBC News, DW
Dive deeper · 13 more factsShow less
  • As of Thursday evening, researchers and spokespeople from nine security firms (CrowdStrike, ESET, Google Threat Intelligence Group, Huntress, Palo Alto Networks, Recorded Future, SecureWorks, Sophos, Trail of Bits) told NBC News they had not seen any successful attacks. NBC News only
  • Sophos' Don Smith said it had seen only a couple of real exploitation attempts across its telemetry. NBC News only
  • Palo Alto Networks' Unit 42 said it had seen over 200 proof-of-concept exploit code examples, all under investigation, and had not seen the flaws exploited in the wild. NBC News only
  • Trail of Bits CEO Dan Guido said a 10-year veteran employee needed a full day to exploit the vulnerabilities using an advanced AI model; he said open-weight AI models typically struggle with such complex flaws. NBC News only
  • Amazon Web Services said honeypots showed hackers attempting to exploit the PHP vulnerability at least four days before it was made public; it said it was unclear whether the attempts would have succeeded in real-world systems. NBC News only
  • Cloudflare CEO Matthew Prince said the company had been in talks for months about patching the flaw and that none of its customers were affected. NBC News only
  • PHP is used by an estimated 69% of all websites; researchers quietly found the two vulnerabilities in August. NBC News only
  • Agencies including the FBI, NSA, European cybersecurity authorities and Australian intelligence agencies recommended websites go offline until patched, and dozens of major websites did so. NBC News only
  • The White House said it was informed of the issue last week and that US federal agencies were assessing the impact on government systems. DW only
  • Websites taken offline included Finland's government public web services, the Dutch cybersecurity agency's site, the Dutch RIVM and Tweede Kamer sites, and Edinburgh council's site. BBC only
  • The Paris Police Prefecture website was taken offline, Germany's government IT service took down some PHP sites, and Belgium's Foreign Ministry temporarily blocked its online presence. DW only
  • The current PHP version is 8.5.12, and PHP 8.1 and older are no longer supported. TechCrunch only
  • Security firm watchTowr said it confirmed the vulnerabilities are real. Ars Technica only

Context

Governments worldwide urged organizations to consider taking PHP-based sites offline after patches for two critical flaws were released Wednesday. One day later, NBC News reported that nine major security firms had seen no successful exploitation in the wild, though attempts and proof-of-concept code were circulating.

Experts cited by NBC News said the flaws appear technically difficult to exploit and warned the threat could persist for weeks or longer, including the possibility of undetected compromises.

Conflicting Reports

  • Earlier coverage attributed to Cloudflare CTO Dane Knecht a statement that early attacks were emerging, and said Patchstack had received reports of active exploitation; NBC News's latest report says nine security firms had seen no successful attacks as of Thursday evening, and Cloudflare CEO Matthew Prince said no customers were affected.
  • Earlier coverage cited Sansec expecting mass attacks within 15 minutes of release (Ars Technica); NBC News reports few, if any, reports of widespread damage.

How the Agent Panel Scored This

Independent AI personas each scored importance 1–10; the story's score is a trimmed mean (highest and lowest votes dropped). Vote spread: 1.

8 Science & Tech Analyst Two critical unauthenticated PHP flaws affecting a platform used by about 69% of websites prompted government agencies and dozens of major sites, including Wikipedia, to go offline, a concrete widespread impact despite no confirmed in-the-wild exploitation yet.
8 Business Analyst A critical unauthenticated remote-code flaw in PHP, used by about 69% of websites, prompted government agencies and major sites like Wikipedia and government portals to go offline, a concrete widespread operational impact despite no confirmed in-the-wild exploitation yet.
8 Informed Citizen Critical unauthenticated PHP flaws affecting about 69% of websites prompted government advisories and dozens of major sites, including government and Wikipedia, to go offline, with impact likely lasting weeks.
8 News Editor Critical PHP flaws affecting about 69% of websites prompted government recommendations to go offline and dozens of major sites, including government and Wikipedia, actually went down, which is a significant concrete impact despite no confirmed in-the-wild exploitation.
7 Policy Expert Government agencies including the FBI, NSA, and European authorities recommended taking sites offline and dozens of major websites, including government sites, did so, affecting many people despite no confirmed successful exploitation yet.
7 Critical Reader Critical unauthenticated PHP flaws affecting about 69% of websites led governments and major sites like Wikipedia and government portals to take systems offline, a concrete widespread impact, though the story's core finding is that no successful exploitation has been confirmed yet.
7 Global Affairs Analyst Critical PHP flaws affecting roughly 69% of websites prompted government agencies and dozens of major sites to go offline, a concrete widespread impact, though no confirmed successful exploitation has been reported yet.

Sources (12)

← All stories