On Wednesday, 21 October, the PHP project shipped emergency releases for two critical flaws in the programming language behind almost 70% of websites. France, Denmark, Finland and the Netherlands took government websites offline while they patched, and Downing Street said some 'limited' UK services might go dark for the same reason. AI uncovered the flaws. The researchers who found them believe that is what makes the discovery significant.
For construction and property firms, the implications are fairly straightforward. PHP powers WordPress, Drupal and Joomla, so your company website could be affected. The same goes for an ageing intranet, a client portal managed by a subcontractor, or a document system hosted by a supplier. The problem lies in PHP itself, not in how the software built on top of it was written.
The bigger point is about speed. Researchers using frontier models have just found and weaponised a bug that sat in widely used code for more than a decade, and OpenAI says it expects more of these soon. That changes how a firm should think about every piece of software it does not control, which in construction is most of it.
What happened?
The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, have been nicknamed php2shell. Both score 9.2 out of 10 on the CVSS v4.0 severity scale. They allow attackers to run their own code on a web server without logging in.
The risk is particularly high for Apache servers running mod_php. According to the PHP security advisory, an attacker can exploit the flaws with a single request, before the application code even runs. There are no complete workarounds. Updating is the only safe option.
Which versions are affected?
The fixes are available in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older versions no longer receive regular updates from the project, although minimal source backports have been published for versions 7.4, 8.0 and 8.1.
How AI helped uncover the flaws
The discovery came through OpenAI's Patch the Planet initiative. Security firm Calif began auditing PHP on 30 July and reported an unauthenticated remote code execution vulnerability on 11 August, identified with OpenAI's GPT-5.6 Sol. Security firm Wiz independently reported the same underlying flaw on 24 August.
OpenAI then coordinated a two-month effort involving Cloudflare and other partners to prepare fixes before public disclosure. The initiative also involved CISA, the Office of the National Cyber Director and the White House.
As part of the effort, OpenAI published a PHP version checker as a Codex skill and committed $1 billion in subsidised access to its Daybreak security models for organisations with limited security resources.
The disclosure did not go to plan
The PHP Foundation says the CVE identifiers leaked on 20 October, forcing it to bring the release forward by a day. Chainguard, meanwhile, published patched images more than six hours before the embargo lifted.
The early release had consequences. Cloudflare reported seeing attack traffic targeting its customers during that window.
The bug is old. The exploit is new
Calif traces the underlying memory-limit problem to research by Stefan Esser in 2004. In 2024 PHP had its first external security audit in years, and a core developer found the first signs of the out-of-memory issue while fixing something else. Nobody could prove it was exploitable, each fix option carried a trade-off, and the small security team stalled. The PHP Foundation's own words: 'the delay was a structural failure, caused by both the security team's decision process and its lack of resources.'
Then came the models. Wiz says turning these flaws into working exploits meant chaining several bugs and adapting to each target's memory layout, work that was 'at the edge of what human researchers could practically achieve'. With frontier AI, 'a single researcher completed in a week what previously would have taken a world-class team months of work.' Calif's list of confirmed pre-authentication targets includes WordPress, Drupal, Joomla, MediaWiki, Roundcube webmail, Magento, phpMyAdmin, Nextcloud, Laravel and Symfony.
This changes the economics of both discovery and exploitation. As AI reduces the effort needed to develop and adapt complex exploits, vulnerabilities that once seemed impractical to exploit become viable targets.
For anyone running a server, 'too hard to exploit' has stopped being a reason to leave something unpatched.
There is a counterweight. Calif's Ryan Austin says no special harness or private model was used, and the finds came from knowing PHP's history and pointing the model at it: 'No model is simply capable of unearthing "all bugs" with simple prompts. At least for now.' The PHP Foundation agrees: tools now find bugs faster than ever, 'for defenders and attackers alike', but a person still makes every call on the fix.
Where PHP hides in a construction business
Most firms in our sector do not think of themselves as running PHP. They run a website, a few portals and whatever the IT provider installed. The National Cyber Security Centre's alert on 21 October lists six priority actions. The first is to identify systems running PHP across your infrastructure, internet-facing first, without limiting the search to old versions. The sixth is the one most firms will miss: monitor third-party software vendors, 'including for appliances and services that may bundle PHP'. The Dutch NCSC has published an inventory of software products with a PHP dependency.
So the questions for whoever looks after your technology are concrete.
Which of our websites, microsites and landing pages run WordPress, Drupal or Joomla, and what PHP version is under each one?
Has the host confirmed in writing that it has applied 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor backport?
Do we run any portals, document exchanges, webmail or self-hosted tools such as Nextcloud, and are any of them on PHP 8.1 or older with no update path?
Which contractors, consultants and suppliers hold our project data on their own PHP-based portals, and have we asked them the same questions?
If something cannot be patched today, has it been taken offline or isolated, and has anyone checked it for signs of compromise, as the NCSC advises?
The FBI's cyber division gave the same blunt advice on Wednesday: take websites offline if they cannot be updated immediately. A marketing site going dark for an afternoon is a far smaller problem than a tender portal quietly leaking.
The patching will take months
The disclosure is done. The clean-up is not. Charl van der Walt, Head of Security Research at Orange Cyberdefense, told the Associated Press the most intense fixing will happen over the next few weeks but it could be 'months or years before all the stragglers are weeded out', because organisations first have to recognise they are running PHP at all, then find who owns each system, then decide when and whether it can be patched.
The potential blast radius, if you like, of this is frankly, enormous.
The numbers bear him out. CyberScoop reports that among servers disclosing their version, VirusTotal found around 758,000 running PHP 5.4 through 8.1, branches that no longer receive security updates, against 272,000 on supported ones.
Kelly Shortridge, Chief Product Officer at Fastly, told the same outlet the gap between disclosure and widespread, repeatable exploitation for a flaw of this severity 'is typically hours to a few days'. CISA said it had not observed exploitation at the time of its release, which is a reason to move now rather than a reason to relax.
James Sullivan, Director of Cyber and Tech at the Royal United Services Institute, called it 'staggering' that some of the flaws are more than a decade old, while cautioning against doom: the same capability that helps attackers find bugs helps defenders fix them. Probably true over time. This week, the only tool that works is the boring one.
Takeaway
Treat this as a supply chain exercise rather than an IT ticket. The software your firm depends on is mostly written and hosted by other people, and a flaw in a shared component reaches all of them at once.
AI has compressed the gap between 'theoretical' and 'exploited' from years to days, and the researchers involved say more is coming. Get the PHP inventory done this week, get written confirmation from hosts and partners, and put a standing question about patch timelines into supplier onboarding and your project information requirements. The next php2shell will not wait for the next contract renewal.
We track the stories where AI collides with the built environment every week, including the ones that land in your IT team's inbox before they land in yours. Subscribe to the Project Flux newsletter and get the briefing on Monday morning.
Links and Stuff
All content reflects our personal views and is not intended as professional advice or to represent any organisation.
