A pair of newly disclosed bugs in the PHP programming language sent a chunk of the internet scrambling today, as Wikipedia, 4chan, DeviantArt, government sites in the Netherlands and Finland, and even Pokémon Home went offline or were taken down as a precaution. The culprit is a severe PHP vulnerability that security researchers say could let an attacker seize full control of a server without ever needing a username or password.
What Is PHP and Why So Many Sites Are Affected
PHP is a server-side programming language that quietly runs a huge share of the web, including WordPress sites and Wikipedia. According to the analytics firm W3Techs, PHP powers roughly 69 percent of websites where the server language is known, and security scanner VirusTotal counts about 3.8 million sites currently running PHP with an open port. That scale is exactly why a single flaw in the language can ripple out to such a wide range of unrelated sites in a single day.
What the PHP2Shell Vulnerabilities Actually Do
The PHP Foundation disclosed two issues. One, tracked as CVE-2026-109618, involves out-of-memory handling that can interrupt PHP while request data is only partially set up, so cleanup later treats invalid data as valid. The other, CVE-2026-109619, involves stale internal state surviving after its memory has been freed, which a later request on the same worker can mistakenly reuse. In plain terms, both let an attacker achieve “unauthenticated remote code execution,” meaning they can run their own code on a server, alter its content, or pull data out of it without logging in at all.
Notably, the underlying flaw isn’t new. The bugs have been in PHP for roughly 20 years. The PHP Foundation says an exploit for one of them was theorized back in 2024, but no concrete attack was found, and security firm Wiz says exploiting it required an exceptionally complex chain of steps at the edge of what human researchers could practically achieve. What changed is AI. OpenAI says a security group called Calif used its GPT-5.6 Sol model to identify the critical flaw, while Google-owned Wiz independently found and reported the vulnerabilities using AI as well. Wiz has called the discovery “among the most severe vulnerabilities discovered … in software history,” and OpenAI described it as one of the most impactful security issues in recent memory.
How Bad Is This, Really
Bad enough that the NSA’s Cybersecurity team and the UK’s National Cyber Security Center both urged organizations to take systems offline entirely if they can’t patch immediately. Cloudflare’s CTO said the company was already seeing early attacks the night before this went public. A successful exploit can hand an attacker passwords, API keys, cryptographic certificates, and entire databases, plus the ability to run code that turns a compromised server into a launchpad for attacking other vulnerable machines. Because the exploit chain is now public and AI makes replicating it far easier, the window between disclosure and widespread attacks is unusually short.
What You Should Actually Do
If you’re just browsing the web, there isn’t much direct action to take, since this targets servers rather than your device. The main risk to regular users is that a compromised site could be used to push malware, so it’s reasonable to be cautious about visiting sites that haven’t confirmed they’re patched. If you want to be extra careful, check the social accounts of sites you use often for updates before visiting.
If you run a website, the checklist is more urgent. Squarespace and Wix users are unaffected since those platforms don’t run PHP. Everyone else, including customers of Hostinger, GoDaddy, and Bluehost, should check their PHP version immediately. GoDaddy says any site on PHP should assume it’s affected and update right away, and that sites still on PHP 8.1 or older need to upgrade since no official fix is coming for those unsupported versions. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to php.net. If your site handles sensitive data or payments and you’re on managed hosting, it’s worth confirming with your provider exactly when the patch lands, and disabling the site in the meantime if you can’t get a firm answer.
The Bottom Line
This isn’t a routine update notice. Two PHP bugs that sat in the code for about 20 years became practically exploitable almost overnight because AI tools closed the gap between “theoretically possible” and “easy to pull off.” For everyday readers, the main takeaway is to be a bit more cautious about which sites you trust until patches roll out broadly. For anyone running a PHP-based site, even a small blog, checking your version today and applying the fix is not optional.
Source: The Verge
Where to buy
As an Amazon Associate I earn from qualifying purchases.
