Two critical PHP flaws trigger emergency response

Two critical vulnerabilities in the PHP programming language are forcing emergency patches, precautionary shutdowns and urgent warnings across the internet. The flaws affect a language that underpins a large share of the web, including many sites built on content management systems and custom server-side applications. Security researchers say the bugs can be chained into unauthenticated remote code execution, meaning an attacker could run their own code, alter content and reach stored data without an administrator login or password.

The disruption has touched major properties and small sites alike. Websites including 4chan, DeviantArt and Wikipedia were affected, along with countless smaller blogs and business sites. Some Dutch and Finnish government agencies took their sites offline as a precaution. The NSA Cybersecurity account on X recommended that organizations take systems offline if an immediate update was not feasible, and the UK National Cyber Security Centre issued similar advice. Even Pokémon Home and Pokémon Champions were taken offline.

The vulnerability is not new in the ordinary sense. It has been present in PHP for roughly 20 years, but exploiting it required an exceptionally complex chain of steps at the edge of what human researchers could practically achieve, according to security firm Wiz. Powerful AI models changed that calculation by making it easier to turn an obscure bug into a dangerous exploit.

What the vulnerabilities do

The PHP Group says hackers could use the two flaws for unauthenticated remote code execution. One issue, tracked as CVE-2026-109618 and described as RCE via out-of-memory corruption, involves out-of-memory handling that can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat invalid data as valid. The second, CVE-2026-109619 and described as RCE via stale global state, involves request-owned internal state that can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.

In practical terms, the flaws matter because they can give an attacker a foothold on a server rather than merely exposing a single page or account. A compromised server can become a platform for stealing passwords, API keys, cryptographic certificates and databases of sensitive information. Attackers could also execute code on those servers and use them as vectors to attack other vulnerable servers. That makes the issue a supply-chain and infrastructure risk, not just a website problem.

Why PHP matters so much

PHP is one of the most widely used server-side programming languages. A web technology survey service says PHP is used by 69.3 percent of all websites whose server-side programming language is known, including popular sites such as Wikipedia and WordPress. A separate internet security scanner currently registers about 3.8 million sites running PHP with at least one port open. Those figures help explain why a PHP flaw can become an internet-wide event rather than a niche software problem.

The language is common in shared hosting, managed WordPress deployments, e-commerce systems and custom applications. Many site owners do not write PHP directly; they rely on a hosting provider, a content management system or a plugin ecosystem. That distance can make patching harder, because the person responsible for the site may not control the PHP runtime. The vulnerability may sit in a layer managed by a hosting company, a platform team or an agency. When a critical fix lands, the work is not only writing a patch but getting every affected deployment to install it.

AI-assisted discovery changes the timeline

OpenAI said an AI security group called Calif identified a critical PHP flaw using GPT-5.6 Sol, while Google-owned Wiz independently discovered and reported the vulnerabilities using AI. The PHP Foundation said an exploit for one of the vulnerabilities was theorized in 2024, but no concrete vectors were found and other concrete issues with clear impact overshadowed those concerns. The current disclosure shows how quickly AI-assisted research can move a long-theorized weakness from the margins into an urgent operational problem.

The involvement of AI cuts both ways. It can help defenders find bugs at scale, but it also lowers the cost of turning a complex vulnerability into a working exploit. Once details are public, a determined attacker may need far less specialized knowledge than before. That is why the warnings have been unusually direct. OpenAI described the issue as one of the most impactful security issues in recent memory. Wiz called it among the most severe vulnerabilities discovered in software history. The CTO of Cloudflare said early attacks were already emerging.

How serious is the risk?

The PHP Group says basically any site running PHP is at risk. The potential impact is hard to overstate. Full server control can expose user accounts, customer records, payment data, private messages and internal credentials. It can also allow an attacker to modify pages, inject malware or redirect visitors. A compromised site can be used to attack visitors or other servers, which means the damage can spread beyond the original host.

Not every site will face the same risk. A static site with no server-side code is not affected in the same way. A site running on a platform that does not support PHP, such as Squarespace or Wix, is in a different position. But for the many sites that do run PHP, the safe assumption is that they need to verify their version, apply the fixed release and confirm that their hosting provider has done the same. GoDaddy said any site using PHP should assume it is affected and update to the fixed release as soon as possible. It also said sites running PHP 8.1 or older should upgrade to a newer version, because those versions are no longer supported and no official fix will be coming.

What site owners should check

Site owners should start by identifying whether their site uses PHP and which version is running. A simple blog can be affected just as a large storefront can. Managed hosting customers should check with their provider about when the fix will be deployed. Customers of hosting services such as Hostinger, GoDaddy and Bluehost should be especially cautious. If a site sells products or services or stores sensitive data, disabling it until the host patches PHP may be the safer option.

The patching burden is uneven. Some organizations have automated deployment pipelines and can roll out a fix quickly. Others depend on third-party agencies, shared hosting controls or legacy applications that have not been updated in years. Older PHP versions are a particular concern because they are no longer supported and will not receive an official fix. For those deployments, migration is not merely a security best practice; it is the only path to a supported runtime.

What ordinary users can do

For casual internet users, there is not much to do directly. The vulnerability affects servers running PHP and does not necessarily target visitors. However, compromised sites could be used to spread malware or steal valuable data. Users who want to be extra cautious can check the social accounts of sites and services they frequently use to see whether those services have posted updates before visiting. It is also wise to be alert to unexpected password prompts, unusual downloads or changes in site behavior.

The bigger responsibility sits with site operators, hosting companies and platform providers. The response requires inventory, patching, verification and communication. Organizations need to know which systems run PHP, which versions they use and whether those versions are still supported. They need a plan for taking critical services offline if a patch is not yet available. They also need to watch for signs of exploitation, because a site can appear normal while an attacker has already established access.

Key facts

• Two critical PHP vulnerabilities are enabling unauthenticated remote code execution on vulnerable servers.
• The flaws have affected major sites and services, including Wikipedia, 4chan, DeviantArt, Pokémon Home and Pokémon Champions.
• Dutch and Finnish government agencies took sites down as a precaution, and security agencies in the United States and the United Kingdom issued warnings.
• PHP is used by 69.3 percent of websites whose server-side language is known, according to a web technology survey service.
• An internet security scanner registers about 3.8 million sites running PHP with at least one port open.
• The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619.
• AI-assisted research by Calif and Wiz helped uncover the flaws, while the PHP Foundation said an exploit had been theorized in 2024 without concrete vectors.
• GoDaddy advised any site using PHP to assume it is affected and update to the fixed release as soon as possible.
• PHP 8.1 and older versions are no longer supported and will not receive an official fix.

For organizations still running unsupported versions, the absence of an official fix makes migration urgent rather than optional.

Source: The Verge News