Two critical security vulnerabilities have been found in PHP, an open-source programming language widely used to run websites and web applications, prompting emergency responses worldwide. Reports by U.S. CNBC and Japanese IT outlet ITmedia on Oct. 22 said the flaws, known as “PHP2Shell,” allow attackers to remotely execute malicious code on servers.

The PHP development project on Oct. 21 (UTC) released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which fix two vulnerabilities rated as critical. The flaws are CVE-2026-109618 and CVE-2026-109619. One causes incomplete data to be treated as normal data when processing stops due to insufficient memory. The other leaves internal state after freeing memory written by a request, affecting other requests. The Apache module method (mod_php) was seen as the most dangerous because it has been shown that attacks are possible with unauthenticated requests alone.

The U.S. National Security Agency (NSA) on Oct. 22 local time urged organisations using PHP to prepare security updates. It warned that attackers could directly access server file systems and databases. It recommended switching the system offline if immediate updates are difficult. The Federal Bureau of Investigation (FBI) and cyber security authorities in Singapore, Britain, Australia, Canada and the European Union (EU) issued similar alerts.

Amazon said it detected attack attempts with its threat detection system, “MadPot,” even before the vulnerability was disclosed. It added it has not confirmed how attackers obtained information about the vulnerability.

The incident is also drawing attention for the role AI played in finding the vulnerabilities. OpenAI said security company Calif found 1 of the 2 issues using its “GPT-5.6 Sol.” Google-owned security company Wiz discovered both independently. Wiz was reported to have used GPT-5.6 Sol, Google’s “Gemini 4 Argon” and its in-house AI, “Wiz Atlas.” OpenAI said it led a coalition of maintainers and security researchers over the past two months to coordinate fixes and pre-emptive responses.

OpenAI forecast that vulnerabilities found by AI will surge over the coming months. “AI can find critical vulnerabilities, but the same capability can also help develop attack tools,” it warned. It assessed that in this case AI found the vulnerabilities before attackers, securing time to defend. OpenAI also proposed a five-step response framework, from vulnerability verification to support for deployment after patches.

In Japan, Codomon, Base (BASE), Cygames and Pixiv temporarily suspended services as a precaution. Prime Minister Sanae Takaichi (다카이치 사나에) also requested updates on her X account. The PHP development team stressed that “there is no complete mitigation and updating is the only safe choice.”