Think about what you did online today. You may have read the news, ordered food, checked a bank balance or booked a train ticket. You probably never wondered what keeps those websites running. On 21 October 2026, a small group of engineers released an emergency fix for a serious flaw in PHP, a programming language that powers a huge part of the web, after weeks of urgent work.
PHP works behind the scenes of a website. When you open a page, PHP often helps the site fetch information, handle your request and put the page together. It is more than 30 years old, and WordPress and Drupal, two of the most popular tools for building websites, run on it. According to W3Techs, which tracks web technology, PHP is used by about 70.5 per cent of the websites whose server-side language is known. That does not mean 70 per cent of the internet is in danger. It means PHP is everywhere, from government services and online shops to banks and media sites.
On 21 October, the PHP project released new versions: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They fixed two critical flaws, CVE-2026-109618 and CVE-2026-109619, each scoring 9.2 out of 10 for severity. Under the right conditions, an attacker with no password and no special access could run their own code on a server. Both flaws sit in the parts of PHP that almost every request touches. One involves what happens when a request hits PHP’s memory limit at exactly the wrong moment, when PHP can leave half-finished data behind and later treat it as valid. The other involves a fatal error at the wrong point, which can leave PHP pointing at memory that belonged to an earlier request. Imagine a hotel room that is not properly cleaned between guests, so the next guest walks in and finds the last guest’s things still lying around. In a computer, that kind of mix-up can be turned into a way in. Older PHP versions, 8.1 and below, no longer get updates from the PHP project, so they stay at risk unless a Linux distributor or support vendor has added the fix itself.
None of this came as a complete surprise to the PHP team. In 2024, PHP went through its first outside security audit in years, arranged by the PHP Foundation with funding from Germany’s Sovereign Tech Agency. While fixing one of the audit’s findings, a developer spotted the first signs of the memory problem. Nobody could show how an attacker would use it, and other bugs looked more urgent. The team also knew the fix would not be easy. Each option had a cost: it could break older websites, create new ways to crash a server, or force changes in the extensions that other developers have built. The work stalled for months. The PHP Foundation has since admitted that the delay was a “structural failure”, blaming both how the security team makes decisions and a lack of resources.
Things changed in the summer of 2026. On 30 July, the security firm Calif began an audit of PHP as part of OpenAI’s Patch the Planet programme. On 11 August, Calif researcher Ryan A reported a remote code execution flaw with the same root cause as the problem found in 2024. OpenAI reported the same root cause on the same day, and the security firm Wiz sent its own report on 24 August. Now the team knew how serious the problem really was, and fixing it became the top priority.
AI played a real part in this story. Earlier this year, the PHP Foundation worked with Alpha-Omega, a group that funds open source security, to scan PHP using Anthropic’s Claude Mythos. It has since added other tools, including OpenAI’s Daybreak Red, to check reports and exploits. But AI has also created new work. The security team has published 15 CVEs since 1 July, and it has handled more than 100 reports that turned out to be invalid, duplicates or impossible to reproduce. The Foundation says AI helps sort and check reports, but a person makes every call and works on every patch. That is the heart of the matter. Finding bugs is getting faster, but deciding how to fix them is still slow human work.
The team had planned to disclose everything on 22 October, and that plan broke down two days early. On the afternoon of 20 October, the two CVE numbers began to circulate on forums and social media, along with wrong details. No technical information had leaked, but the team moved up its announcement and shifted the release to 21 October. Hours later, Calif accidentally posted a video showing its proof of concept working. The video was deleted, but copies spread. Then, early on 21 October, the software company Chainguard published fixed software images more than six hours before the official release. The PHP Foundation said this let anyone study the fix before other users could update. The team said it had not found any working exploits at the time of release, but security firms warned that attackers would now try.
So who fixes the internet when it breaks? The PHP Foundation answers plainly: security work on the language still “depends on a small group of foundation-funded developers and a little volunteer help.” Its own published reports have put the number of paid developers at about ten. This year it has added security hires too, but the team is still small. PHP is not the only case. Many open source tools that businesses rely on are maintained by small teams, and the Foundation says it needs more support from the companies and governments that depend on them. It is now asking them to sponsor its work before the next problem becomes an emergency.
If you run a website, the advice is simple: update PHP to the fixed version, or ask your hosting provider whether they have. If you only visit websites, there is nothing for you to do. But the next time a page loads without a problem, remember that somewhere, a small group of people probably worked through the night to keep it that way.
Subscribe Deshwale on YouTube
