What is the PHP vulnerability and who is at risk?

A critical PHP vulnerability let attackers plant code on unpatched web servers, and many sites were still exposed after public disclosure. PHP is the server-side scripting language behind a large share of the web, and the fix depends less on a clever patch than on finding every instance still running the vulnerable version.

What the PHP vulnerability actually allowed

The PHP vulnerability let an attacker get code of their own executed on a web server running an affected PHP version. That is remote code execution, the most serious class of web flaw, because it turns someone else's machine into a place to run commands rather than a place to read pages.

The practical consequences follow from what a web server holds: computing power, stored data, credentials and the IP addresses that identify it. A compromised site can be used to mine cryptocurrency on the host's hardware, to relay traffic that hides an attacker's origin, or to reach data the application could already access.

This is quiet compromise rather than visible ransomware. As the Guardian's global technology reporter Aisha Down put it in the Today in Focus episode, the intrusion "doesn't announce itself"; a site can be serving malicious code and its owner may never know.

The transcript does not specify the affected PHP versions or the exact parser defect, so treat any version list you see elsewhere as something to confirm against the PHP project's own security advisories before acting.

Why the flaw became public before patches landed

The flaw reached attackers before defenders finished patching, and the early leak is the reason. Disclosure norms give vendors time to ship a fix and notify major operators; when details circulate on forums first, that head start disappears and every unpatched server becomes a target at once.

Down reported that a researcher identified the issue in August 2026, and that OpenAI also reported related findings. The PHP Foundation's account, as described in the episode, pointed toward a researcher as the source of the leak, while other parties were involved in circulating the information. Those accounts do not fully agree, so the origin remains contested.

The dispute matters for how the incident is judged. A premature leak is a coordination failure; a researcher going public is a disclosure decision. The transcript supports the former reading more than the latter, and neither version is settled in the reporting available on 22 October 2026.

Several parties are named in that circulation story, and none is identified in the episode beyond the Foundation and OpenAI. Details published before an advisory can be reused by anyone who reads them; that is the mechanism, regardless of intent.

How widespread the risk really is

Reports during the incident put PHP's share of websites at 70% to 76%, which is why a single library bug reached government portals and small charity sites alike. The range came from the podcast discussion rather than a single published census, so treat it as an order of magnitude.

W3Techs, which tracks server-side languages, reported a similar scale in its October 2026 survey: PHP is used by the large majority of sites whose server language can be detected. The exact percentage shifts monthly as sites migrate.

The distribution matters more than the average. Many small sites run PHP through a content management system on shared hosting, where the owner never picks a version and may not receive a direct security notice. Large operators have staff for this; a wildlife charity does not.

Sites reported down during the scramble included Oxford City Council, Edinburgh and Dutch government services, and the Metropolitan Police, according to the episode. Outages of that kind point to emergency patching, not necessarily to successful compromise.

Why patching is slower than it sounds

Patching PHP is slow because the work is inventory before it is update. A server, a container image, a forgotten staging environment and a plugin that bundles its own runtime can each run a different version, and the update only helps the instances somebody finds.

Down's comparison in the episode was to locating lead pipes in a building: the answer differs from site to site, and the map is often missing. Shared hosting complicates it further, because the version is chosen by the provider rather than the site owner.

A sane sequence for an administrator looks like this:

1. Enumerate every PHP runtime in use, including staging, containers and third-party integrations.
2. Compare each against the fixed releases in the PHP security advisories.
3. Test the update against the application, since major-version jumps can break extensions.
4. Patch and confirm the running version with php -v or a phpinfo() page that is removed afterwards.
5. Review logs for unexpected outbound connections, new scheduled tasks or unfamiliar files.

Sites that cannot patch quickly should at minimum remove exposed administrative panels and review access logs, but the durable answer is a current runtime plus a maintenance contract that names who patches it.

Is AI changing how fast flaws get found?

AI tools are speeding up vulnerability discovery, and the incident shows both sides of that. Down said the researcher used a frontier large language model alongside deep expertise, and that state-sponsored actors are already using AI to find exploits.

The honest limit is that a model does not find every bug. The episode makes that point directly: the researcher did not discover a new defect but recognised an old one, and the expertise was what connected the model's output to a real, exploitable flaw. Claims that AI will find "every bug everywhere" outrun the evidence.

What is supported is narrower and still significant. Automated search makes it cheaper to scan large codebases, and the same capability is available to people who will not disclose what they find. Defence therefore has to assume faster discovery, which makes patch latency the variable that matters.

The flaw itself is decades-old infrastructure surfacing again. Down's framing in the episode was that the internet is a microcosm of legacy infrastructure that keeps being used because replacing it is expensive, and that almost no funding goes into maintaining it.

PHP versus other server-side languages

PHP is not uniquely fragile, but its install base and its long tail of unmaintained sites make disclosure events here unusually broad. The table compares the language roles involved in this story on the dimensions the episode actually addresses.

JavaScript and PHP were described in the episode as once serving distinct purposes on the web and now overlapping, since both tell a website what to do. Node.js is the JavaScript runtime most often used for that server-side role.

Language or runtime	Primary role	Maintenance reality	Evidence in this incident
PHP	Server-side scripting	Often chosen by host or CMS, not the owner	Affected; sites taken down during patching
JavaScript	Browser and, via Node.js, server scripting	Frequent version churn	Not implicated in the flaw
Python	Server scripting, scripting, AI tooling	Managed by application teams	Used in the vulnerability research
Rust	Systems and performance-sensitive services	Growing server use	Not part of this incident

The comparison that matters for a site owner is not language quality. It is who is contractually responsible for updating the runtime, and whether that person has a way to find every instance.

What site owners should check first

The first check for any site owner is the running PHP version and whether it matches a fixed release listed in the project's advisories. Hosting control panels usually show this; where they do not, a temporary phpinfo() page answers it in seconds.

After the version, look for evidence of use. Unexpected outbound connections, CPU load that does not match traffic, new files in upload directories and unfamiliar scheduled jobs are all consistent with a compromised host, though none is proof on its own.

For sites on managed hosting or a mainstream content management system, the practical step is to ask the provider in writing which PHP version the site runs and when it was last updated. A provider that cannot answer is itself the finding.

Anyone running an end-of-life PHP branch should plan the upgrade as a project rather than a hotfix. Abandoned extensions are the usual blocker, and a staged migration with a test environment beats an emergency patch during the next disclosure.

FAQ

• What is the PHP vulnerability? It is a flaw in the PHP server-side scripting language that let an attacker run their own code on unpatched web servers. The affected versions and the exact defect were not specified in the reporting discussed here, so confirm them against the official PHP security advisories.

• Which websites were affected? Any site running an unpatched affected PHP version was exposed, including small sites on shared hosting. Sites reported down during patching in October 2026 included Oxford City Council, Edinburgh and Dutch government services, and the Metropolitan Police.

• Has the flaw been fixed? The episode describes a fix being applied by large operators, with websites going down as developers patched. It also says many sites, particularly those without a developer, plausibly never patch.

• Did AI find the flaw? A researcher found the issue in August 2026 and used a frontier large language model along with domain expertise, according to the reporting. The model assisted the discovery; it did not independently find every bug.

• Does a secure padlock in the browser mean a PHP site is safe? No. HTTPS encrypts the connection between a browser and a server; it says nothing about whether the server runs a patched PHP version or has already been compromised.

Source video