How AI made PHP flaws exploitable, and what to do now

On October 21, 2026, two critical vulnerabilities were disclosed in PHP. PHP is the programming language behind 70% of websites, including sites built on WordPress, Drupal, and Joomla. Every PHP version released in the last decade, back to version 5.4, is affected by at least one of the flaws. These flaws had been in PHP’s code for more than a decade, and researchers turned them into working attacks with help from AI.

At Nexcess, we host websites and applications that run on PHP, and we started patching the servers we manage on the day of disclosure.

What the PHP vulnerabilities are

The PHP vulnerabilities are two flaws in PHP’s core engine, tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 on the Common Vulnerability Scoring System (CVSS), the industry scale for how severe a flaw is. An attacker who exploits them can run their own code on a server without logging in, and read sensitive data from server memory, including passwords, login tokens, and API keys. 

Because the flaws are in PHP itself, a website that runs on PHP can be exposed even when its own code has no security problems. Wiz Research, the security team that found the flaws, demonstrated working attacks on WordPress, Drupal, and Joomla.

How the PHP flaws were disclosed and patched

The PHP team, Wiz Research, Calif, and OpenAI worked together on the fix and on testing it. PHP released patched versions on October 21, the same day the details went public. Cloudflare, AWS, Google, Microsoft, Automattic, and other providers prepared protections for customers who couldn’t install the patch right away. Our role was to build the patched versions for the servers we manage and install them.

Why the flaws went unexploited for more than a decade

The flaws sat in PHP’s code for more than a decade because turning them into a working attack took rare expertise and time. An attacker would have had to chain several bugs together and then adjust the attack for each server’s PHP version, settings, and memory layout. An attack that worked on one server could easily have failed on the next.

Security teams have treated difficulties like this as a form of protection. When a known flaw needs a top specialist and weeks of work to exploit, teams have rated it as lower risk and scheduled the fix for later.

How AI made the PHP flaws easy to exploit

AI made the flaws easy to exploit by doing much of the adaptation work that once required a specialist for every target. According to Wiz Research, frontier AI models helped adapt the attack to different PHP versions and settings, analyzed why attempts failed, learned from the failures, and then tried again. One researcher using these models completed in about a week what Wiz estimates would have taken a team of top specialists months.

In the past, the difficulty of an attack was a cost the attacker had to pay. AI has lowered that cost, so flaws that once looked too complex to exploit are now realistic targets. If you run websites, review any flaw you rated low risk because it looked hard to exploit. Patch quickly once a fix is released, and build protection into your hosting that’s in place before the next flaw is disclosed.

How we patched the servers we manage

We patched the servers we manage by building, testing, and installing updated PHP versions across our platforms, starting on the day of disclosure.

• We built patched PHP packages for dozens of PHP versions in under a day.
• We tested the patched packages on WordPress, WooCommerce, and Magento sites before they reached customers. 
• Cloud Sites was fully patched on October 21, the day of disclosure, and a large majority of Managed Cloud servers were patched within a day. 
• cPane, Interworx and Plesk servers on Linux received patched versions across the fleet, and we published progress on our status page as the work went on.

We also sent each customer a notice based on the patch status of their own servers, so customers whose servers still needed work heard that directly.

Which servers still need work

Some servers still need work, and a patch won’t fix all of them. Some servers run an end-of-life operating system or PHP version, meaning one that no longer receives security updates. Those servers need an upgrade, and we are contacting those customers directly. PHP that a customer installs outside the control panel is the customer’s responsibility to update. If you host with us, our status page shows where each platform stands.

What to check on any server that runs PHP

If you run PHP on your own servers or with another host, these checks show whether you are exposed and what to fix first. Wiz Research states that installing the PHP security update is the only complete fix.

• Find every PHP installation you run, including copies bundled inside other software. An installation you don’t know about won’t get patched.
• Check the PHP version on every server that is reachable from the internet, and confirm it includes the October 21 fix.
• Upgrade any end-of-life PHP versions. Your control panel shows which PHP version each site uses, and the PHP project lists the versions it supports on its supported versions page.
• Check the guidance from your hosting provider, web application firewall, and content delivery network (CDN). Cloudflare, Fastly, Google Cloud, Microsoft, and other providers released protections that reduce the risk until the update is installed.
• Check your server logs for the warning signs Wiz Research lists. These include:
  • Unusual file-upload requests followed by memory-limit errors or repeated HTTP 500 errors
  • Unusually large or malformed PHPSESSID cookies
  • PHP worker processes that restart without explanation.
• Turn on two-factor authentication for every account that can access your hosting, so a password exposed through server memory can’t be used on its own to log in.

How our hosting plans build in protection before the next disclosure

Our managed WordPress and WooCommerce hosting now comes in two plans, Pro and Elite. Both include continuous malware scanning with automatic removal, a web application firewall, daily backups, and 24/7/365 support. Elite adds advanced attack blocking and longer backup retention.

For server hosting customers, we’re also adding the following protections:

• 24/7 security incident response, with notices sent only to the customers affected, is rolling out to all server customers now. 
• Server monitoring and alerts for managed servers arrive in Q4 2026.
• Cloudflare Enterprise becomes available to server customers as an optional add-on in Q4 2026.
• Managed detection and response becomes available as an optional add-on for servers with Acronis EDR by the end of 2026.
• Required two-factor authentication becomes an option for account owners on all accounts by the end of 2026.

Talk to us about hosting your PHP applications

If you run PHP applications and want to know how we would host and protect them, our team is happy to walk you through the plans and the patching process.