A pair of severe security vulnerabilities discovered in the PHP programming language has spurred urgent disruptions and shutdowns across the internet today. The flaws, collectively referred to as PHP2Shell, have impacted widely varied web operations, from massive platforms such as Wikipedia, DeviantArt, and 4chan to localized business blogs, gaming ecosystems, and government portals.
As organizations scrambled to safeguard infrastructure, several Dutch and Finnish government agencies took their websites offline as a precautionary measure. Global cybersecurity authorities issued stark advisories, with the NSA Cybersecurity account on X and the United Kingdom’s National Cyber Security Center both recommending that organizations take vulnerable systems offline if an immediate patch is not feasible. Kotaku reported that gaming services Pokémon Home and Pokémon Champions were also taken offline.
The AI Breakthrough Behind a 20-Year-Old Flaw
According to cybersecurity firm Wiz, the underlying code defects have resided within PHP for roughly two decades. However, exploiting the issues previously required an exceptionally complex chain of steps situated at the outer boundary of what human researchers could practically accomplish. Advanced artificial intelligence models have dramatically shifted that dynamic, enabling security researchers—and potential malicious actors—to rapidly transform obscure, legacy defects into functional, dangerous vulnerabilities.
OpenAI stated that an artificial intelligence security group known as Calif identified a critical PHP vulnerability utilizing the GPT-5.6 Sol model. Simultaneously, Google-owned firm Wiz independently identified and disclosed the vulnerabilities through AI-driven research. While the PHP Foundation noted that an exploit for one of the flaws was theorized as far back as 2024, no concrete attack vectors were established at the time, and other immediate issues with demonstrable impact took precedence.
Understanding the Technical Flaws
The PHP Group warned that attackers can leverage both vulnerabilities to execute unauthenticated remote code execution. This allows unauthorized actors to run arbitrary code, alter site content, and access stored data on an affected server without possessing an administrative login or password.
The first flaw, designated as CVE-2026-109618 (GHSA-w8hw-w9fx-j79w), involves remote code execution via out-of-memory corruption. Under this condition, out-of-memory handling can interrupt PHP processing while internal request data remains only partially initialized. During request cleanup, the runtime environment may subsequently handle that invalid data as valid.
The second flaw, tracked as CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp), enables remote code execution through stale global state. In this scenario, request-owned internal state can persist even after its underlying memory has been freed. A subsequent web request assigned to the same worker process can end up executing against that stale state prior to normal initialization resetting the memory space.
Vast Exposure Across the Global Web
The scope of the vulnerability is extensive due to PHP’s pervasive footprint across internet infrastructure. According to web technology survey firm W3Techs, PHP is utilized by 69.3 percent of all websites whose server-side programming language is known, powering massive content management platforms like WordPress alongside online encyclopedias like Wikipedia. Data from security scanner VirusTotal indicates approximately 3.8 million sites are running PHP with at least one port openly exposed.
Industry experts have categorized the severity in historic terms. Wiz described the flaws as among the most severe vulnerabilities ever discovered in software history, while OpenAI characterized the situation as one of the most impactful security issues in recent memory. The PHP Group cautioned that essentially any site running PHP must be considered at risk. Threats are already moving rapidly; Cloudflare’s chief technology officer noted that the company was already seeing early attacks emerging in the wild.
Should an attacker succeed in exploiting the vulnerabilities, the consequences are severe. A successful compromise grants full administrative control over a server, exposing sensitive databases, user passwords, API keys, and cryptographic certificates. Compromised servers can also be repurposed as attack vectors against additional web targets.
Mitigation Steps for Administrators and End Users
For casual web users, the threat does not target consumer devices directly, though compromised web destinations can potentially be used to distribute malware or siphon personal information. Concerned individuals are advised to check the official social media channels of services they frequent for status announcements before browsing.
For website operators, immediate remediation is required. Webmasters must determine the exact version of PHP their servers operate. Users relying exclusively on proprietary website builders such as Wix or Squarespace are unaffected, as those systems do not support or run PHP.
Customers utilizing shared or dedicated web hosting providers like GoDaddy, Hostinger, and Bluehost face heightened risk. Hosting provider GoDaddy stated that any web property using PHP should operate under the assumption that it is affected and immediately apply fixed releases. GoDaddy further warned that websites running PHP version 8.1 or older must upgrade to a modern supported release, as these older versions have reached end-of-life status and will not receive official security patches.
Site owners utilizing managed hosting setups should contact their providers to confirm patch deployment schedules. Security advisories emphasize that any website handling e-commerce, customer accounts, or confidential databases should be temporarily taken offline until the host confirms PHP has been fully updated.
