AI-assisted PHP flaws knock major websites and government services offline

What happened

Two critical vulnerabilities in the PHP programming language triggered widespread disruption across the internet on October 21, 2026. According to The Verge, the fallout hit high-traffic sites including 4chan, DeviantArt and Wikipedia, along with countless smaller pages. Government agencies in the Netherlands and Finland took their websites down as a precaution, and both the NSA's cybersecurity account on X and the UK's National Cyber Security Center advised organizations to pull systems offline if they could not patch immediately. Kotaku, cited by The Verge, reports that Pokémon Home and Pokémon Champions were also taken down.

The discovery itself is notable: OpenAI says an AI security group called Calif identified one of the critical flaws using GPT-5.6 Sol, while Google-owned security firm Wiz independently found and reported the vulnerabilities using AI-assisted research.

The two vulnerabilities

The PHP Group, which maintains the language, says the flaws enable unauthenticated remote code execution. In practice, that means an attacker could run arbitrary code, modify site content, or read stored data without any login or password.

• CVE-2026-109618 (GHSA-w8hw-w9fx-j79w), described as RCE via out-of-memory corruption: when memory exhaustion interrupts PHP mid-request, internal request data may be only partially initialized, and cleanup logic can later treat that invalid data as trustworthy.
• CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp), described as RCE via stale global state: internal state owned by one request can outlive the memory that backs it, and a subsequent request handled by the same worker process may act on that stale state before normal initialization resets it.

Why it took 20 years to surface

According to Wiz, the underlying weakness has been present in PHP for roughly two decades, but weaponizing it previously demanded a chain of steps so intricate that human researchers could barely achieve it in practice. The PHP Foundation adds that an exploit for one of the flaws was theorized back in 2024, but no concrete attack vector was found and other issues with clearer impact took priority.

Powerful AI models changed that equation. What was once an academic concern became a practical, reproducible exploit, and both the discovery and the threat now hinge on the same capability.

How serious is it

Severe, by every account in The Verge's reporting. The PHP Group considers essentially every PHP site at risk. OpenAI, which participated in the research, called it one of the most impactful security issues in recent memory, and Wiz ranked it among the worst vulnerabilities ever found in software. Cloudflare's CTO said the company was already observing early attacks the night before publication.

Successful exploitation could hand an attacker full control of a server: passwords, API keys, cryptographic certificates and entire databases. Compromised machines could then be used as launching points against other vulnerable servers. And because AI dramatically lowers the effort required, exploitation is now within reach of any determined attacker now that the details are public.

What operators and users can do

Individual users have little direct recourse, since the flaws affect servers rather than browsers, but The Verge suggests checking a service's official social channels for updates before logging in. For site owners:

• Determine which PHP version your site runs. Squarespace and Wix users are unaffected because those platforms do not support PHP.
• Customers of Hostinger, GoDaddy, Bluehost and similar hosts should update to the fixed release immediately. GoDaddy says any site using PHP should assume it is affected.
• Sites still on PHP 8.1 or older must upgrade to a newer version; those releases are unsupported and will never receive an official fix.
• Managed hosting customers should ask their provider when the patch will land. Anyone storing sensitive data or running transactions may want to disable their site until the patch is confirmed.

Why it matters

PHP underpins a staggering share of the web. W3Techs puts it at 69.3 percent of all sites whose server-side language is known, and VirusTotal's scanner currently counts roughly 3.8 million PHP sites with at least one open port. The episode also signals a shift in security economics: AI systems uncovered a flaw that twenty years of human review had noticed but could not practically exploit, and the same tooling is available to attackers. The long-standing assumption that a bug is too complex to exploit is no longer a reliable defense, and legacy code bases everywhere may hold similar latent risks.