Two critical vulnerabilities in the PHP programming language have caused widespread service outages, affecting platforms such as Wikipedia, 4chan, and DeviantArt. Government agencies in the Netherlands and Finland, along with services like Pokémon Home, have taken systems offline as a precautionary measure.
The flaws, identified as CVE-2026-109618 and CVE-2026-109619, allow for unauthenticated remote code execution. Attackers can potentially gain full control of servers, access sensitive data including passwords and API keys, or use compromised infrastructure to launch further attacks.
Security firm Wiz and the AI security group Calif discovered these vulnerabilities using advanced AI models. While the underlying issues have existed in PHP for approximately 20 years, they were previously considered too complex to exploit until AI simplified the process of identifying these attack vectors.
According to W3Techs, PHP powers 69.3 percent of websites with known server-side languages. VirusTotal reports that approximately 3.8 million sites running PHP currently have at least one open port. Cloudflare has already observed early exploitation attempts targeting these vulnerabilities.
The PHP Group advises that all sites running the language are at risk. GoDaddy recommends that site owners update to the latest patched version immediately. Sites running PHP 8.1 or older are particularly vulnerable as they are no longer supported and will not receive official security fixes.
