The cloud computing provider said it spotted a hacking attempt against the flaw four days before the weakness was publicly disclosed.
PHP's maintainers released software updates on Wednesday, October 21, 2026, and the US National Security Agency urged all organizations using PHP to update immediately or take affected systems offline.
The NSA has nicknamed the flaws "PHP2Shell."
Wiz, the Alphabet-owned security firm that helped find the bugs, estimates the language powers about 70 percent of websites worldwide, partly because WordPress, the most widely used website-building platform, is written primarily in PHP.
The NSA said the flaws could let attackers take control of a web server without prior access or authentication, which could help them steal sensitive data, disrupt services, or move deeper into a network.
The UK's National Cyber Security Centre said a hacker could take over a site's server without a password or other credentials.
The NSA noted the problems lie in PHP itself, not in a hosted application or its configuration, so any server running an affected version is exploitable.
Some European governments were reportedly taking sites offline while they patched, and the White House said federal agencies are assessing the potential impact on government systems and critical infrastructure.
The bugs went undetected for more than a decade and were uncovered with help from OpenAI and Google AI models. Researchers at Calif and Wiz made the discovery, and OpenAI worked with PHP, Calif and Wiz to verify the flaws and develop patches. OpenAI said it believes frontier AI found the vulnerabilities before attackers did, but warned the same capabilities can help attackers quickly build offensive tools and exploits. The NSA advised organizations to inventory systems that rely on vulnerable PHP versions, apply vendor patches, add enhanced logging, and replace end-of-life PHP services that cannot be patched. It said cyber actors are likely to weaponize the flaws, and that it is prioritizing identification of malicious actors who may try to exploit them. Guidance is available on the PHP.net Security Advisory page.