The PHP development team released emergency updates on Wednesday for two vulnerabilities that security agencies say could let an attacker run code on a web server without logging in. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10 on the CVSS v4 severity scale, and are known as PHP2Shell.

The PHP Foundation said it had issued fixes for current supported versions and urged anyone still on PHP 8.1 or older to upgrade, because those branches no longer receive security updates. The project said the flaws affect PHP installations that serve web requests, and security researchers describe basically any site running PHP as at risk. That reach is what turned a software patch into a global scramble.

The disruption was visible. Finland took government web services offline, the Dutch parliament's lower house and the national cyber-security agency pulled their sites, and the Wikimedia Foundation disabled some of the systems behind Wikipedia as a precaution. The BBC said pages for several of its programmes were unavailable, while 4chan and DeviantArt also went dark. Some operators confirmed a link to the PHP alert; others described maintenance without saying why.

The flaws sit in PHP's handling of memory when a request ends abnormally, such as after an out-of-memory error or a fatal error. A failed clean-up can leave stale or uninitialised data that a later request reuses. In practice, an attacker could read process memory, alter a site, install malware or use one server to reach others. Passwords, API keys and database credentials held in memory are among the data at risk.

AI helped find the bugs. OpenAI said its Patch the Planet programme gave security researchers access to frontier models. Calif, one of the groups involved, found the flaw with GPT-5.6 Sol, and Google-owned Wiz reported an independent discovery. Wiz called it one of the most severe vulnerabilities found in software. The PHP Foundation had planned to publish later, but details leaked on social media on Tuesday and it brought the release forward. The flaws had gone undetected for more than a decade.

Scale is the reason agencies reacted so sharply. W3Techs estimates PHP runs on 69.3 per cent of websites whose server-side language is known, and the BBC, citing Wiz, put the figure at roughly 70 per cent. The Verge, citing VirusTotal, said about 3.8 million sites were running PHP with at least one port open. Not every PHP site is exploitable, because configuration matters, and the exact number already compromised is unknown.

For Bangladesh, the alert matters because the same software sits under many local news, business and government websites. The Daily Star and bdnews24 both carried the warning. WordPress, Joomla, Drupal and Magento all depend on PHP, and these are common foundations for such sites. Shared hosting customers often cannot change the PHP version themselves; the host must do it. Wordfence warned that ordinary content-management updates would not install the PHP fix.

Officials were direct. The US National Security Agency said the flaws could give attackers a direct route into a server's files and databases. Britain's National Cyber Security Centre, the European Union's CERT-EU and Australia's Cyber Security Centre urged operators to patch immediately or take systems offline until they could be secured. Japan's prime minister, Sanae Takaichi, urged website operators to check their systems. Cloudflare's chief technology officer, Dane Knecht, said early attacks were already appearing, and described his company's firewall rules as a stopgap.

Australia's cyber-security centre said it was not aware of active exploitation at the time of its advisory, while Cloudflare and other security firms reported attempts. That gap is one of the unresolved questions: how many servers were attacked before their operators patched, and whether any of those attempts succeeded. The advisories reviewed did not name Bangladeshi sites, and no local outage had been confirmed. It is also unclear how quickly shared hosting companies in Bangladesh will roll out the new versions.

What happens next depends on patch speed. Site owners are being told to check their PHP version, update to a fixed release and restart workers. Those on PHP 8.1 or older must move to a supported branch. Organisations that cannot update immediately are advised to isolate or suspend internet-facing PHP services and keep a web application firewall in place only as a temporary measure. Security agencies also expect phishing messages that exploit the publicity, so users should treat unsolicited patch links with caution.