Two bugs found with AI are behind major issues today for 4chan, DeviantArt, Wikipedia, and the blog where the bar around the corner posts pictures of people’s dogs. The “critical vulnerabilities” were discovered in the PHP programming language, which underpins much of the internet, including any site built on WordPress. But it’s far bigger than that. Some Dutch and Finnish government agencies took their sites down as a precaution. The NSA Cybersecurity account on X recommended that organizations take their systems offline if “an immediate update is not feasible,” as did the UK’s National Cyber Security Center. Even Pokémon Home and Pokémon Champions were taken offline, Kotaku reports.
OpenAI is taking credit for finding the PHP2Shell vulnerabilities, but now someone has to apply all these patches,
The vulnerability isn’t exactly new. It’s been present in PHP for roughly 20 years, but exploiting it “required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve,” according to security firm Wiz. However, powerful AI models have made it much easier to turn that kind of obscure bug into dangerous vulnerabilities.
As a casual internet user, you might be wondering what exactly the barrage of jargon like “RCE via OOM corruption” means, how concerned you should be, and how exactly a vulnerability this severe flew under the radar for so long.
What is PHP?
W3Techs, a survey service, says that the PHP programming language is used by “69.3 percent of all the websites whose server-side programming language we know,” including popular sites like Wikipedia and WordPress. The internet security site VirusTotal says its scanner currently registers about 3.8 million sites running PHP with at least one port open.
What happened?
According to OpenAI, an AI security group called Calif identified a “critical” PHP flaw using GPT-5.6 Sol, and Google-owned Wiz independently discovered and reported the vulnerabilities using AI. The PHP Foundation says that an exploit for one of the vulnerabilities “was theorized” in 2024, but “no concrete vectors were found and other concrete issues with clear impact overshadowed these concerns.”
Now the PHP Group says hackers could use the two vulnerabilities for “unauthenticated remote code execution,” like running their own code, changing content, and accessing a site’s stored data without needing an administrator login or password.
RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
RCE via stale global state, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.
How serious is it?
Very. The PHP Group says that basically any site running PHP is at risk. OpenAI, which was involved in the vulnerability research, said: “We consider this one of the most impactful security issues in recent memory.” And Wiz said it’s “among the most severe vulnerabilities discovered … in software history.”
Last night, the CTO of Cloudflare said that it was “seeing early attacks emerging.”
It’s hard to understate just how bad this could get. The vulnerabilities could allow an attacker to take full control of a server. That includes gaining access to passwords, API keys, cryptographic certificates, and databases of sensitive information. They could also execute code on those servers, turning them into vectors to attack other vulnerable servers. And, thanks to AI, it’s relatively trivial for a determined hacker to exploit these flaws now that they have been revealed.
What can I do?
As a user, not much. The vulnerability affects servers running PHP and doesn’t necessarily target users directly, but it could use compromised sites to spread malware and steal other valuable data. If you’re feeling extra cautious, check the social accounts of sites and services you frequently use to see if they’ve posted any updates before visiting.
If you have a website, even a simple blog, it’s time to check what version of PHP your site uses, if any. If you’re using a service like Squarespace or Wix, you’re in the clear, as those don’t support PHP. Customers of Hostinger, GoDaddy, Bluehost, or other web hosting services should be more cautious. GoDaddy says that any site using PHP should assume it is affected and update to the fixed release as soon as possible. It also says that sites running PHP 8.1 or older should upgrade to a newer version, as they’re no longer supported and there will not be an official fix coming.
Those on a managed hosting service should check with their provider to see when they should expect the fix to be deployed. If you sell products or services or have any sensitive data on your servers at all, it’s best to disable your site until your host patches their version of PHP.
Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.