Critical PHP Flaws Found With AI Force Global Site Shutdowns

The bugs affect a programming language used by 69.3 percent of all websites whose server-side language is known, according to W3Techs, including Wikipedia and WordPress. VirusTotal says its scanner registers about 3.8 million sites running PHP with at least one port open. The PHP Group said attackers could use the two vulnerabilities for unauthenticated remote code execution, allowing them to run their own code, change content and access a site's stored data without an administrator login or password.

The flaws are RCE via OOM corruption, tracked as CVE-2026-109618 and GHSA-w8hw-w9fx-j79w, and RCE via stale global state, tracked as CVE-2026-109619 and GHSA-6wmf-4rv5-p3rp. In the first, out-of-memory handling can interrupt PHP while internal request data is only partly initialized, and request cleanup may then treat invalid data as valid. In the second, request-owned internal state can survive after its backing memory has been freed, and a later request handled by the same worker may use that stale state before normal initialization resets it.

OpenAI said its AI security group Calif identified a critical PHP flaw using GPT-5.6 Sol, and Google-owned Wiz said it independently discovered and reported the vulnerabilities using AI. OpenAI described the issue as "one of the most impactful security issues in recent memory." Wiz called it "among the most severe vulnerabilities discovered ... in software history."

The vulnerability is not new. Wiz said it had been present in PHP for roughly 20 years, but exploiting it "required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve." Powerful AI models made it easier to turn that obscure bug into a dangerous vulnerability, the firm said. The PHP Foundation said an exploit for one of the vulnerabilities "was theorized" in 2024, but "no concrete vectors were found and other concrete issues with clear impact overshadowed these concerns."

The effects were visible across the internet. The Verge reported that 4chan, DeviantArt, Wikipedia and a small personal blog were affected, and that some Dutch and Finnish government agencies took their sites down as a precaution. The NSA Cybersecurity account on X recommended organizations take systems offline if "an immediate update is not feasible," and the U.K.'s National Cyber Security Center issued the same advice. Kotaku reported that Pokémon Home and Pokémon Champions were taken offline.

The PHP Group warned that basically any site running PHP is at risk. An attacker who gains control of a server could reach passwords, API keys, cryptographic certificates and databases of sensitive information, and could use the server to attack other vulnerable systems. The Verge reported that, thanks to AI, exploitation is relatively trivial for a determined hacker now that the flaws have been revealed.

For ordinary users, the practical advice is limited because the flaws affect servers rather than directly targeting visitors. The Verge reported that users can check the social accounts of sites and services they use for updates before visiting. Website owners should check which PHP version their site runs. Squarespace and Wix do not support PHP, while customers of Hostinger, GoDaddy, Bluehost and other hosts should be more cautious. GoDaddy said any site using PHP should assume it is affected and update to the fixed release as soon as possible, and that sites on PHP 8.1 or older should upgrade because those versions are no longer supported and will not receive an official fix. Managed hosting customers should ask their providers when the fix will be deployed.