Two critical flaws in PHP, a programming language used by as many as 70 percent of websites, have triggered emergency patching and temporary shutdowns across the web. The vulnerabilities could let attackers run malicious code on affected servers, putting sites and services from WordPress installations to government agencies at risk.
Security teams say attempts to exploit the bugs began before the fixes were publicly released. Amazon Threat Intelligence reported detecting an attack on October 17 through a monitoring system designed to lure hackers. Cloudflare CEO Matthew Prince said the company logged thousands of attempts in the hours before disclosure, followed by hundreds of thousands within two hours and millions by the following night.
Now loading...
The flaws, identified as CVE-2026-109618 and CVE-2026-109619, affect PHP versions stretching back about two decades. PHP developers rated them 9.2 out of 10 in severity and issued patches, urging users to update promptly. PHP Foundation executive director Elizabeth Barron said there had been no known successful remote code execution at the time, but stressed that vulnerable systems needed to be secured.
The scale of the risk has forced organizations to weigh patching against taking services offline. DeviantArt, 4chan, Wikipedia-related services, and some Dutch and Finnish government sites were among those affected. The Internet Archive also briefly went offline while its operations team applied fixes, then returned to service. The NSA and the UK’s National Cyber Security Centre advised organizations to consider disconnecting systems if they could not update immediately.
Older services face a harder choice. Two long-running Japanese mobile games, World Quest and Save My Demonic World, are shutting down because their developers say the underlying technology cannot be patched. Since some older PHP versions are no longer supported, the incident could also put parts of the web’s history beyond repair or access.
Security researchers say the underlying bug had existed for years, but exploiting it once required a complicated sequence of steps. Artificial intelligence helped researchers uncover the flaws, raising concerns that similar tools could also make it easier for attackers to turn obscure bugs into practical exploits. OpenAI says a researcher used GPT-5.6 Sol during the discovery process and has released a tool to help developers identify potentially vulnerable PHP versions.
Much of the response depended on a small number of maintainers. Ondřej Surý played a central role in preparing the patch, while the PHP Foundation and security teams worked to alert users and coordinate fixes. Surý has warned that the growing pace of threats is taking a toll on defenders, but hopes the incident will prompt greater investment in the open-source software that underpins much of the internet.
The official threat intelligence report describes detecting exploitation attempts before public disclosure.
