At 9:55 PM Tokyo time on Wednesday, Japanese Prime Minister Sanae Takaichi posted an unusual request on X. Anyone with a public website, she wrote, should check whether it uses PHP and get ready to install a fix the PHP project would release at 11 PM that night. If that couldn’t be done quickly, she said, temporarily taking the website down was one effective way to cut the risk. The post passed 30 million views within hours.
The US National Security Agency, the FBI’s cyber division and the UK’s National Cyber Security Centre issued their own warnings the same day, 21st October 2026. The NSA and FBI recommended that organisations unable to update right away take their systems offline until they can, and the UK centre told anyone who can’t apply PHP’s interim fixes in time to consider doing the same. Some did so within hours: Finland’s government and the Dutch House of Representatives disconnected websites, and in Japan pixiv, DMM, niconico and the online shop builder BASE went into emergency maintenance.
What PHP is and what broke
PHP is a programming language that runs on a website’s server, the computer that hosts the site, and builds each page before it reaches your browser. WordPress is written in it, as are Drupal and Joomla, and with them a large share of business and school websites. W3Techs, which surveys the technology behind websites, finds PHP on 69.3% of sites whose server-side language it can identify.
The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, are in PHP itself, so they affect every website built on it.
- In the first, PHP can run out of memory partway through processing an incoming request, and the clean-up that follows treats half-built data as if it were valid.
- In the second, data belonging to one request can outlive the memory it was stored in, and the next request handled by the same server process can pick it up before PHP resets it.
Both are the kind of memory error an attacker can steer into running their own commands on the server. PHP’s security advisory says both can allow remote code execution, meaning an outsider runs code on the server, without logging in, and rates each 9.2 out of 10 on the CVSS 4.0 severity scale.
PHP considers servers using Apache with mod_php, a common setup where PHP runs inside the web server, the most exposed, and says an exploit has been demonstrated there that fires before any of the website’s own code runs. A WordPress security plugin can’t block that, because the attack lands before WordPress loads. PHP lists its other common setups, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed, as at risk too.
So if your website runs on PHP, the fix has to happen on the server: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, released on Wednesday at 14:00 UTC, which was 5 PM in Nairobi, or a patched package from a Linux distribution, which PHP says got the fixes in advance. PHP also lists interim settings for anyone who needs time, and says they reduce exposure but don’t make a site safe.
Found with AI, and already under attack
Both flaws were found with AI models. Researchers at Wiz, the cloud security company Google bought earlier this year, say they used Wiz’s own tooling with models from Google and OpenAI, found the first flaw on 19th August 2026, reported both to PHP on 24th August, and took over test installs of WordPress, Drupal and Joomla without logging in. They named the pair PHP2Shell and say every PHP version back to 5.4, released in 2012, is affected. OpenAI says researchers at the security firm Calif separately found one of the flaws with its GPT-5.6 Sol model as part of its Patch the Planet programme, and that it worked with the White House and the US Cybersecurity and Infrastructure Security Agency (CISA) on the disclosure.
Details leaked a day before the patches, and attackers are already trying them. Cloudflare, whose network filters traffic for websites before it reaches them, says it saw attack traffic aimed at its customers and attackers changing their payloads to get past its filters, which it switched on for every plan, free accounts included, about nine hours before disclosure. The security firm watchTowr also reported attack attempts but said none had succeeded, and no confirmed break-in had been made public by Wednesday night.
What it means in Kenya
Kenya relies on PHP more than the world average. W3Techs finds PHP on 82.4% of .ke websites whose language it can detect, and WordPress on 84.5% of .ke sites that use a content management system. By 8 PM Nairobi time, neither the Communications Authority nor the National KE-CIRT/CC, the government’s computer emergency response team, had published an advisory on its website.
If you only visit websites, use M-Pesa or shop online, there is nothing for you to install. The work falls on whoever runs each site, and for a business or school on shared hosting that is the hosting company, which controls the PHP version on the server. WordPress says no WordPress update is needed and that your PHP version shows under Tools, then Site Health, then Info, then Server. Within each line, 8.5.12, 8.4.27, 8.3.36 and 8.2.35 or later are fixed. If yours is older than the fixed release in its line, ask your host today whether it has installed a patched package and, if not, when it will.
Sites on PHP 8.1 or older have a bigger job. The PHP project no longer releases those versions, and its security team has published only do-it-yourself source code fixes for 7.4, 8.0 and 8.1, with nothing for anything older. Some Linux distributions and paid support vendors offer their own patches. Among PHP sites W3Techs can identify, 27% still run PHP 7 and 7.7% run PHP 5, and moving them to a supported version can break old themes and plugins, which takes longer than a night.
Earlier this year we reported on how one automated scan of Co-op Bank’s website flagged an exposed WordPress configuration file. PHP2Shell is a worse problem, because it can hand over the server itself, and the PHP-and-WordPress stack it targets is the one most .ke sites run. For any Kenyan site that can’t be moved onto a fixed PHP this week, the NSA and FBI advice applies as written: take it offline until it can be.
Join the discussion