Two AI-discovered vulnerabilities in PHP trigger worldwide site takedowns after details leak on social media

Two critical vulnerabilities in PHP have triggered a worldwide response. The details leaked Tuesday. The PHP Foundation issued a patch on Wednesday, rushing out its planned announcement after the premature disclosure on social media exposed the scale of the problem to organizations worldwide.

The vulnerabilities allow unauthenticated remote code execution on servers running the language, and with roughly 70% of websites dependent on PHP, security agencies on three continents told organizations to patch immediately or take systems offline entirely. The US National Security Agency advised organizations using PHP to take their systems offline if unable to patch immediately, warning that the vulnerability could provide a direct path to the server’s file system or database. The UK’s National Cyber Security Centre urged organizations to apply fixes and consider taking systems offline where immediate remediation is not feasible.

Sites taken offline worldwide

The Wikimedia Foundation took down several systems as a precautionary measure until they could be safely patched, leaving some people unable to access parts of Wikipedia on Wednesday. Finnish government public web services were temporarily shut down. Dutch government websites were taken down, including the lower house of parliament, the Tweede Kamer, while the Netherlands’ national digital identity service and the site of the national cybersecurity centre also went offline. In the UK, Edinburgh, Bristol, and Oxford council websites were taken offline. Belgian, French, and German government sites were taken down temporarily, and in France, local government websites including that of the Paris police prefecture went offline. DeviantArt and 4chan were affected. Pokémon Home and Pokémon Champions were taken offline, per Kotaku. The Australian cyber defence agency was also affected by the outage.

The BBC took pages offline for several programmes including Doctor Who and The Traitors. It has not confirmed a link. The Netherlands’ National Institute for Public Health and the Environment took down its website. Japan’s Prime Minister Sanae Takaichi urged people to check if their publicly available websites ran on PHP. The White House said federal agencies were working with leading AI labs to speed up a fix, while the EU and Australia’s cyber-security counterparts urged PHP users to apply fixes.

Flaws hidden for years, found with AI

OpenAI was involved in discovering the flaw and said frontier AI was key to making the process practical. Calif, part of an OpenAI program called Patch the Planet, identified the PHP flaw using GPT-5.6 Sol. Wiz independently discovered the vulnerabilities using AI. The firm said exploiting the bug required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve, and described the vulnerabilities as among the most severe ever discovered. OpenAI called the discovery one of the most impactful security issues in recent memory. The researcher who found the weakness, however, said they did not use models that were not available to the general public.

The two CVEs are CVE-2026-109618 and CVE-2026-109619. The first involves remote code execution via out-of-memory corruption, where out-of-memory handling can interrupt PHP while internal request data is only partially initialized. The second involves RCE via stale global state, where request-owned internal state can survive after its backing memory has been freed. The flaws went undetected for years. They have been described as more than a decade old, or roughly 20 years, depending on the assessment. According to the BBC, CERT-EU said the vulnerabilities could affect all versions of PHP from PHP 5 onwards, which launched in 2004, and the PHP Foundation says an exploit for one vulnerability was theorized in 2024, but no concrete vectors were found.

A race many don’t know they’re in

WordPress uses PHP. According to the BBC, cyber-security company Huntress said PHP quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and software that doesn’t even advertise it runs PHP under the hood. Don Smith from the Sophos Counter Threat Unit told the BBC that the challenge was not simply installing a patch but finding and managing every instance where PHP was running, and that this would likely be a priority target for hackers. GoDaddy says any site using PHP should assume it is affected and update to the fixed release as soon as possible. The PHP Foundation has issued updates only for the latest versions, and people using PHP 8.1 or older are urged to upgrade as those versions are no longer supported. Squarespace and Wix, which do not support PHP, are not affected. VirusTotal says its scanner currently registers about 3.8 million sites running PHP with at least one port open.

Dane Knecht, CTO of Cloudflare, said early attacks were emerging, as reported by the BBC. Prof Alan Woodward of Surrey University said there would be a long tail of websites that may not be maintained and remain vulnerable, leading to weeks and months of ongoing attacks. “There is this race and some people unfortunately don’t even know they are in the race,” he said. Internet infrastructure expert Michał Woźniak said there would be a lot of automatic exploitation, and that large crime organisations and Russian state actors could use vulnerable sites as a launching pad for DDoS and other cyber-attacks. The UK NCSC told organizations to check for backdoors installed by an attacker, and said organizations should continuously monitor for security updates from third-party software vendors, including appliances that may bundle PHP.