Finance
“Two critical vulnerabilities were discovered in the PHP programming language, which powers about 70% of all websites globally, prompting governments and corporations worldwide to race to patch their systems.”
Plain restatementIn October 2026, two vulnerabilities rated critical were disclosed in PHP, a server-side programming language used by roughly 70% of websites on one commonly cited measure, and operators of government and corporate websites moved quickly to apply patches.
General information only - not financial advice.
This one checks out on its main points. On 20 October 2026 the PHP project gave advance notice of two critical vulnerabilities, and fixes shipped on 21 October 2026 in PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Both flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, are rated 9.2 out of 10 under version 4 of the standard severity scale and can let an attacker run code on a web server without logging in, which matches the post's description. CERT-EU issued a formal advisory and security vendors reported exploitation attempts within days, so the picture of a rapid worldwide patching effort is supported. The one stretch is the headline statistic. The survey the 70% figure comes from reports 69.3% as of 22 October 2026, but only among websites whose server-side language it can actually identify, not all websites on the internet. What remains unchecked here are the post's specific illustrations, including the claimed government site outages and the stated role of AI models in finding the flaws, which could not be verified within this check.
Two [drifted from the evidence:] critical vulnerabilities were [drifted from the evidence:] discovered in [drifted from the evidence:] the PHP programming language, [drifted from the evidence:] which powers about 70% of [drifted from the evidence:] all websites [drifted from the evidence:] globally, prompting governments and [drifted from the evidence:] corporations worldwide to race to [drifted from the evidence:] patch their systems.
[added by the neutral restatement:] In October 2026, two vulnerabilities [added by the neutral restatement:] rated critical were [added by the neutral restatement:] disclosed in PHP, [added by the neutral restatement:] a server-side programming language [added by the neutral restatement:] used by roughly 70% of websites [added by the neutral restatement:] on one commonly cited measure, and [added by the neutral restatement:] operators of government and corporate websites moved quickly to [added by the neutral restatement:] apply patches.
Red-tinted words in the claim drifted from the evidence. Green-tinted words are what a neutral restatement needs.
The trace / claim to source
- Two vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed in October 2026, with the PHP project giving advance notice on 20 October 2026 and shipping fixes on 21 October 2026.
- Both are rated critical, at 9.2 under CVSS version 4.0, matching the post's "9.2 out of 10" phrasing.
- Both can allow unauthenticated remote code execution, matching the quoted phrase in the post.
- PHP is by a wide margin the most used server-side language on the measure cited, at 69.3% as of 22 and 23 October 2026, so "about 70%" is a fair rounding of that specific figure.
- Institutional response is documented: CERT-EU issued a formal advisory to EU institutions, at least one large hosting provider states it patched its entire fleet, and security vendors reported exploitation attempts in the days after disclosure.
- The claim says PHP "powers about 70% of all websites globally," while the source of record measures 69.3% of websites whose server-side programming language W3Techs is able to determine. The denominator is a subset, not the whole web, and sites with an undetectable server-side language are excluded. The number itself is reported correctly; the scope attached to it is wider than the survey supports, which inflates the apparent blast radius of the flaws.
- Whether the share of literally all websites running PHP is close to 70% cannot be determined from the retrieved material, because the publisher's own denominator is restricted to sites with a known server-side language.
- The scale implied by "governments and corporations worldwide" racing to patch is directionally supported by an EU-level advisory, vendor bulletins and a hosting provider's own account, but no comprehensive count of affected or offline government and corporate sites was located.
- Whether the vulnerabilities were "discovered" in the manner the post describes, including the stated role of AI models in finding them, was not verified against any source.
- Whether real exploitation caused the specific site outages the post depicts was not verified.
The vulnerability event is real and recent. CERT-EU records that on 20 October 2026 the PHP project announced an upcoming security release addressing two critical vulnerabilities, and that the PHP team released the fixes on 21 October 2026 at 13:30 UTC in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Tenable records the PHP security team's advance notice of an upcoming release on 21 October 2026 at 14:00 UTC covering two critical vulnerabilities, both rated CVSS v4.0 9.2. Snyk states the two flaws, CVE-2026-109618 and CVE-2026-109619, are both rated CVSS v4.0 9.2 and can allow unauthenticated remote code execution. Arctic Wolf Labs refers to the pair collectively as PHP2Shell and analyses active exploitation attempts and botnet activity following the release. Symantec's write-up notes that details were public before the fixes shipped. AhnLab records that the rating of 9.2 was issued under CVSS v4.0 in the PHP Security Team's official notice of 20 October 2026. On the reach statistic, the source of record is narrower than the claim. W3Techs states: "PHP is used by 69.3% of all the websites whose server-side programming language we know." That reading is dated 22 October 2026 on the PHP detail page, and the languages overview page shows the same 69.3% share for PHP, ahead of JavaScript at 8.2% and Ruby at 7.1%, dated 23 October 2026. On the patching response, evidence of institutional reaction exists: CERT-EU issued a formal advisory to EU institutions, and SiteGround states PHP announced the release in an advance notice on php.net on 20 October 2026 and that the fixes are now applied across all its servers as of 22 October 2026. Help Net Security published preparation guidance for site owners on 21 October 2026.
Complete reasoning
The reply is formatted for pasting into the thread where the claim is circulating.
Ask this case
Answers come only from the case file above; nothing is added.
Were the two PHP vulnerabilities real, and how serious were they?
Yes. Two flaws, CVE-2026-109618 and CVE-2026-109619, were disclosed in October 2026 and are rated 9.2 out of 10 under CVSS version 4.0. Both could let an attacker run code on a web server without logging in.
Is it true that PHP powers about 70% of all websites?
That figure is a bit misleading. W3Techs reports PHP is used by 69.3% of websites whose server-side language it can identify, not 70% of all websites globally, so the claim's scope is wider than the data actually supports.
Did governments and corporations really rush to patch their systems?
This is supported but not fully measured. CERT-EU issued a formal advisory to EU institutions, a major hosting provider says it patched its entire server fleet, and security vendors reported exploitation attempts within days, though no complete count of affected organizations was found.
Were AI models involved in discovering these vulnerabilities, as some versions of the claim suggest?
The investigation could not verify this. The case file does not confirm or deny any role for AI models in finding the flaws.
Did the vulnerabilities actually cause government websites to go offline?
This was not established. The case file notes that specific claims of government site outages could not be verified.