Level 1 - Absolute Beginner
PHP is a computer language. Very many websites use it. About 7 of every 10 websites use PHP.
Experts found two big problems in PHP. Bad people can use these problems to get inside a website computer.
Some governments turned off their websites to stay safe. They will turn them on again after they fix the problem.
The PHP team made a fix on Wednesday. Website owners must update their computers now. Experts say this is one of the biggest computer problems in years.
- computer language
- A set of words and rules used to tell a computer what to do.
- website
- A place on the internet with pages you can read.
- expert
- A person who knows a lot about one subject.
- problem
- Something that is wrong and needs to be fixed.
- fix
- To repair something that is broken or wrong.
- update
- To make software new again by adding the newest version.
- government
- The group of people who run a country.
- safe
- Not in danger.
Level 2 - Elementary
Two serious security problems have been found in PHP, the computer language behind most of the world's websites. Experts say that attackers can use the problems to run their own commands on a website's computer.
The problems are old. Every version of PHP released in the last ten years has at least one of them. A security company called Wiz found them while working with the PHP team and with OpenAI.
Governments in Europe and in other regions turned off their websites while they installed the fix. South Korea told companies to check their systems at once, and the American NSA also sent out a warning.
The PHP team released an emergency update on Wednesday. Cloudflare, a company that protects websites, added new protection at 3:02 in the morning. The owners of about 55 million websites now need to update their software.
- security
- Protection against danger or attack.
- attacker
- A person who tries to break into a computer system.
- command
- An instruction that tells a computer to do something.
- version
- One particular form of a piece of software, usually with a number.
- emergency
- A sudden dangerous situation that needs fast action.
- install
- To put new software onto a computer.
- warning
- A message telling people about a danger.
- protect
- To keep something safe from harm.
Level 3 - Intermediate
Two critical vulnerabilities in PHP, recorded as CVE-2026-109618 and CVE-2026-109619, have forced government websites across Europe and elsewhere offline this week as administrators rushed to install an emergency patch. Both flaws allow an attacker to run code of their own choosing on a vulnerable server.
The scale is what makes this serious. PHP sits underneath content management systems including WordPress, Drupal, Joomla and Magento, and the security firm Censys counted roughly 2.58 million internet-facing hosts and 54.9 million web properties running it. Every PHP release of the past decade is affected by at least one of the two bugs. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
How the flaws were found matters almost as much as the flaws themselves. The security company Wiz coordinated the disclosure with the PHP team and with OpenAI, and said that frontier AI models substantially lowered the barrier to turning long-standing weaknesses into working exploits. OpenAI described the issue as one of the most impactful security problems in recent memory.
Attacks have already started. Cloudflare said it detected exploitation attempts and deployed firewall rules at 3:02 UTC, while Ubuntu shipped updated packages the same day. Wiz compared the situation to Log4Shell, the 2021 Log4j flaw that organisations spent months patching, and warned that attackers will probably try to install hidden control tools on servers at scale.
- vulnerability
- A weakness in software that an attacker can take advantage of.
- patch
- A small software update that repairs a fault.
- server
- A computer that stores a website and sends its pages to visitors.
- content management system
- Software that lets people build and edit a website without writing code.
- disclosure
- The act of making a security problem public, usually after a fix exists.
- exploit
- A piece of code written to take advantage of a vulnerability.
- firewall
- A system that filters network traffic to block attacks.
- at scale
- In very large numbers, across many systems at once.
Level 4 - Advanced
The uncomfortable detail in this week's PHP emergency is not the severity of the two vulnerabilities but their age. CVE-2026-109618 and CVE-2026-109619 have been present in every release of the language for roughly a decade, sitting beneath an estimated 54.9 million web properties, and they surfaced now because the economics of finding them changed.
The security firm Wiz, which coordinated disclosure with the PHP maintainers and with OpenAI, put the matter plainly: frontier AI models substantially lowered the barrier to converting long-standing weaknesses into working exploits. That sentence is the actual news. A latent defect that resists discovery for ten years is, in practical terms, not a defect at all. The same defect, once a capable model can be pointed at it, is an emergency.
The response has been correspondingly blunt. Governments in several European countries took public services offline rather than risk compromise, the NSA issued a warning, and South Korea opened an emergency response channel urging organisations to harden their systems. Cloudflare reported detecting exploitation and pushed firewall rules at 3:02 UTC. Patched builds, 8.5.12, 8.4.27, 8.3.36 and 8.2.35, shipped alongside the disclosure, and Linux distributions followed within hours.
Wiz's comparison to Log4Shell is instructive but may understate the problem. Log4j was a single library within one ecosystem; PHP underpins WordPress, Drupal, Joomla and Magento, and the long tail of unmaintained installations is vast and largely unreachable. The immediate task is patching, and it will take months. The durable question is what becomes of a software estate built on the quiet assumption that obscure code is safe because nobody had the patience to read it.
- severity
- How serious or damaging something is.
- latent
- Present but not yet active or noticed.
- maintainer
- A person responsible for keeping a software project working and updated.
- compromise
- In security, the successful breach of a system by an attacker.
- harden
- To strengthen a system against attack.
- distribution
- A packaged version of an operating system, especially Linux.
- ecosystem
- The interconnected set of tools, libraries and users around a technology.
- long tail
- The very large number of small, scattered cases beyond the well-known ones.
.jpg%3Fwidth%3D800&w=3840&q=75)
Talk about this article with KatePractice this story's vocabulary in a real spoken conversation with your AI tutor