BCS Analysis: The global PHP incident

Summary

• PHP is a serve-side programming language supporting internet infrastructure; AI has uncovered vulnerabilities causing a global incident
• The NCSC encourages organisations to update to the latest fixed version of PHP, and warns that if you are unable or it would take too long, to take systems offline temporarily
• The incident may lead to a 'patch wave' of software security updates; the NCSC and experts say organisations should prepare now
• Steve Sands FBCS says 'There are likely to be many more unknown vulnerabilities in software that AI tools will find in the coming months. Organisations need to scale up their ability to respond...'’

The AI assisted exposure of a critical flaw in programming language PHP has led many websites to be taken offline and the PHP Foundation to issue critical software updates. Government security agencies have issued guidance and urge PHP users to patch their systems.

Speaking about the incident, Steve Sands FBCS, Chair of the BCS Information Security Specialist Group, said: ‘There are likely to be many more unknown vulnerabilities in software that AI tools will find in the coming months. Organisations need to scale up their ability to respond to these in a similar fashion to this one.’

The National Cyber Security Centre (NCSC), in its guidance note, wrote: ‘Organisations using any version of PHP are affected and all organisations are highly encouraged to update to the latest fixed version. Organisations using older versions of PHP are highly encouraged to update to a fully supported version.’

Whilst patches are available, the NCSC warns, if you are unable to apply temporary mitigations, or applying them would take too long, you should consider taking the system offline until a solution can be applied.

Steve Sands said: ‘Taking systems offline is for many organisations a very last resort. Their online presence is often linked to their revenue streams.  So, anything which disrupts availability has significant financial implications.  The fact that everyone else is similarly affected may help with the reputational fallout, but not with any consequential loss of income.’

Recovery, mitigation and looking to the future

Whilst website owners and practitioners grapple with the boots-on-the ground reality of the PHP incident, industry leaders are already pointing to lessons that can be learned and, in some cases, ones that should already have been recognised.

Analysts and commentators are already suggesting that the PHP2Shell is a watershed moment. Long-ignored technical debt, such as end-of-life legacy software, can no longer be viewed as tomorrow’s problem. Rather, AI — in the wrong hands — has the potential to turn such systems into headaches and problems for businesses.

For you

Be part of something bigger, join BCS, The Chartered Institute for IT.

As a result, the NCSC expects there will be a ‘forced correction’ to address this technical debt across all types of software, including open source, commercial, proprietary and software as a service.

Ollie Whitehouse, Chief Technology Officer (CTO) for the NCSC, writing on the organisation’s blog, stated: ‘This is why we are encouraging all organisations to prepare now for when a ‘patch wave’ arrives; a rush of software updates that will need to be applied across the technology stack to address the disclosure of new vulnerabilities.’

As the story evolves, BCS and its members will offer its analysis on these wider lessons.

So, what is PHP and why is it important?

PHP stands for PHP: Hypertext Preprocessor. Just to make things a little less clear, PHP is a recursive acronym where the first ‘P’ stands for PHP itself.

Its meaning is, of course, less important than what it does. And what it does is very important.

PHP is a server-side programming language that runs behind the scenes on a web server.

When you click a link, log into an account, or submit a form, PHP acts as the middleman. It takes your request, talks to the database to retrieve the right information, stitches it all together into a standard HTML webpage, and sends that finished page to your browser.

What vulnerabilities have been uncovered?

Security researchers have disclosed two critical memory-safety flaws, collectively dubbed ‘PHP2Shell’ (CVE-2026-109618 and CVE-2026-109619), in PHP.

The vulnerabilities allow hackers to execute malicious commands remotely on a web server without even needing to log in. The underlying errors have existed in PHP’s code since version 5.4, released over a decade ago.

However, demonstrating how to exploit them required an exceptionally complex chain of steps previously deemed too difficult for human hackers to practically achieve.

How does AI fit into the PHP incident?

The underlying memory-safety flaws (CVE-2026-109618 and CVE-2026-109619) were not new. They have existed in PHP’s codebase since version 5.4 was released in 2012.

The critical point is: for over a decade, human security auditors had been unable to map out a practical way to weaponise them. The chain of memory manipulation required to intentionally exhaust the server and trick it into reusing corrupted data was simply too convoluted for manual testing.

The breakthrough in uncovering the PHP vulnerabilities occurred in August 2026, driven by two separate security teams using advanced artificial intelligence.

The initial discovery was made by a researcher at the cyber security start-up Calif, funded by OpenAI’s ‘Patch the Planet’ project. By deploying OpenAI's GPT-5.6 Sol model against PHP's historical source code, they successfully mapped the first version of the exploit. Weeks later, cloud security firm Wiz independently uncovered the flaws using their own autonomous tool, Wiz Atlas, combined with Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol.

Rather than simply asking the AI to find bugs, researchers used the models to untangle the complex memory failures. The AI was able to refine intricate exploitation techniques across different server setups and test security patches, automating the gruelling manual testing that had thwarted human experts for 14 years.

Technical debt and software bills of materials

The NCSC’s warning of a ‘forced correction’ puts the idea of technical debt under the microscope.

What is technical debt? It’s a metaphor borrowed from finance: releasing imperfect code or making do with ageing solutions is akin to taking out a loan that your future self will eventually have to repay.

Like traditional debt, the real danger is compounding. As new systems are built on top of outdated foundations, bringing the stack up to modern standards becomes increasingly difficult and expensive.
And, this is why technical debt is moving from being an IT operational headache to an urgent, board-level risk.

Which brings us back to the PHP incident. It demonstrates that legacy infrastructure can be increasingly exposed in a world where vulnerability discovery and exploitation are becoming faster and more automated. As a result, organisations are being forced to confront those compounding dependencies buried within their technology environments.

As Steve Sands FBCS notes: ‘Many organisations don’t have the necessary records showing exactly what software runs in which systems. There has been a growing recognition of the importance of a software bill of materials (SBOM), which documents all software in a system.' A software bill of materials (SBOM) is a formal, machine-readable inventory of every third-party component, open-source library, and dependency built into a software application. It’s effectively a list of ingredients.

'As more vulnerabilities are now being detected (by the good guys and the bad guys)', Steve continues, 'it’s even more important that organisations can identify (quickly) whether they have the affected software and be able to react.’

Those measured ‘down for maintenance’ signs which dotted the web after news of the incident broke may have concealed a less comfortable reality. Not simply, ‘we’re fixing things’,  more: ‘We’re working out whether we are using vulnerable PHP modules and, if we are, what we’re going to do about it.’