PHP: The Three Letters That Caused Widespread Website Outages Today

Two significant bugs related to AI have led to major issues affecting platforms like 4chan, DeviantArt, Wikipedia, and even local blogs showcasing pet photos. These “critical vulnerabilities” were found in the PHP programming language, which is foundational to a large portion of the internet, including sites built on WordPress. The impact is widespread; some government agencies in the Netherlands and Finland have taken their websites offline as a precaution. Cybersecurity experts have advised organizations to disconnect their systems if immediate updates aren’t possible, and even popular services like Pokémon Home and Pokémon Champions have gone offline.

This vulnerability isn’t entirely new; it has existed in PHP for about 20 years. However, exploiting it previously required a complex series of steps that were challenging for human researchers, according to the security firm Wiz. With the advent of powerful AI models, turning this obscure bug into a serious threat has become much easier.

If you’re a casual internet user, you might be puzzled by terms like “RCE via OOM corruption” and how such a severe vulnerability could have remained unnoticed for so long.

What is PHP?
According to a survey service, PHP is utilized by approximately 69.3 percent of all websites with known server-side programming languages, including major sites like Wikipedia and WordPress. An internet security site reports that around 3.8 million sites are currently running PHP with at least one open port.

What happened?
An AI security group identified a “critical” PHP flaw using advanced AI tools, and another firm independently discovered and reported these vulnerabilities. The PHP Foundation noted that an exploit for one of these vulnerabilities was theorized back in 2024, but no concrete methods were identified at that time, overshadowed by other pressing issues.

Now, the PHP Group warns that hackers could leverage these vulnerabilities for “unauthenticated remote code execution,” allowing them to run their own code, alter content, and access stored data without needing admin credentials.

– **RCE via OOM corruption, CVE-2026-109618**: This vulnerability arises from how PHP handles out-of-memory situations, potentially allowing invalid data to be treated as valid during request cleanup.
– **RCE via stale global state, CVE-2026-109619**: This issue occurs when internal request states persist after their memory has been freed, which can be exploited by subsequent requests handled by the same worker.

How serious is it?
Extremely serious. The PHP Group indicates that virtually any site running PHP is at risk. Experts involved in the research have labeled this as one of the most significant security issues in recent memory. Reports indicate that early attacks are already being observed.

The potential fallout is severe. These vulnerabilities could enable attackers to gain full control of servers, accessing sensitive information like passwords, API keys, and databases. They could also execute code on compromised servers, using them to target other vulnerable systems. With AI making exploitation easier, the threat level has escalated.

What can I do?
As a user, your options are limited. The vulnerabilities primarily affect servers running PHP and don’t directly target users, but compromised sites could still spread malware or steal data. If you want to be cautious, check the social media accounts of the sites you frequently use for any updates before visiting.

If you own a website, even a simple blog, it’s crucial to verify which version of PHP your site is using. If you’re on platforms like Squarespace or Wix, you’re safe, as they don’t utilize PHP.

For customers of web hosting services like Hostinger, GoDaddy, or Bluehost, it’s essential to be vigilant. GoDaddy has advised that any site using PHP should assume it is affected and should update to the latest fixed version immediately. Sites running PHP 8.1 or older should upgrade, as those versions are no longer supported and won’t receive official fixes.

If you’re on a managed hosting service, check with your provider about when they plan to deploy the necessary fixes. If your site handles transactions or sensitive data, it’s wise to disable it until your host has patched their PHP version.