TechNewsSecurityPHP: The three letters that shut down sites all over the internet todayOpenAI is taking credit for finding the PHP2Shell vulnerabilities, but now someone has to apply all these patches,OpenAI is taking credit for finding the PHP2Shell vulnerabilities, but now someone has to apply all these patches,by Terrence O’Brien and Jay PetersOct 21, 2026, 8:36 PM UTCShareGiftIf you buy something from a link, The Verge may earn a commission. See our ethics statement.Photo by Amelia Holowaty Krales \/ The VergeTwo bugs found with AI are behind major issues today for 4chan, DeviantArt, Wikipedia, and the blog where the bar around the corner posts pictures of people\u2019s dogs. The \u201ccritical vulnerabilities\u201d were discovered in the PHP programming language, which underpins much of the internet, including any site built on WordPress. But it\u2019s far bigger than that.<\/p>\n
Some Dutch and Finnish government agencies took their sites down as a precaution. The NSA Cybersecurity account on X recommended that organizations take their systems offline if \u201can immediate update is not feasible,\u201d as did the UK\u2019s National Cyber Security Center. Even Pok\u00e9mon Home and Pok\u00e9mon Champions were taken offline, Kotaku reports.The vulnerability isn\u2019t exactly new. It\u2019s been present in PHP for roughly 20 years, but exploiting it \u201crequired an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve,\u201d according to security firm Wiz.<\/p>\n
However, powerful AI models have made it much easier to turn that kind of obscure bug into dangerous vulnerabilities.As a casual internet user, you might be wondering what exactly the barrage of jargon like \u201cRCE via OOM corruption\u201d means, how concerned you should be, and how exactly a vulnerability this severe flew under the radar for so long.W3Techs, a survey service, says that the PHP programming language is used by \u201c69.3 percent of all the websites whose server-side programming language we know,\u201d including popular sites like Wikipedia and WordPress. The internet security site VirusTotal says its scanner currently registers about 3.8 million sites running PHP with at least one port open.According to OpenAI, an AI security group called Calif identified a \u201ccritical\u201d PHP flaw using GPT-5.6 Sol, and Google-owned Wiz independently discovered and reported the vulnerabilities using AI. The PHP Foundation says that an exploit for one of the vulnerabilities \u201cwas theorized\u201d in 2024, but \u201cno concrete vectors were found and other concrete issues with clear impact overshadowed these concerns.\u201dNow the PHP Group says hackers could use the two vulnerabilities for \u201cunauthenticated remote code execution,\u201d like running their own code, changing content, and accessing a site\u2019s stored data without needing an administrator login or password.RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.RCE via stale global state, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): request-owned internal state can survive after its backing memory has been freed.<\/p>\n
A later request handled by the same worker may use that stale state before normal initialization resets it.Very. The PHP Group says that basically any site running PHP is at risk. OpenAI, which was involved in the vulnerability research, said: \u201cWe consider this one of the most impactful security issues in recent memory.\u201d And Wiz said it\u2019s \u201camong the most severe vulnerabilities discovered \u2026 in software history.\u201dLast night, the CTO of Cloudflare said that it was \u201cseeing early attacks emerging.\u201dIt\u2019s hard to understate just how bad this could get. The vulnerabilities could allow an attacker to take full control of a server.<\/p>\n
That includes gaining access to passwords, API keys, cryptographic certificates, and databases of sensitive information. They could also execute code on those servers, turning them into vectors to attack other vulnerable servers. And, thanks to AI, it\u2019s relatively trivial for a determined hacker to exploit these flaws now that they have been revealed.As a user, not much. The vulnerability affects servers running PHP and doesn\u2019t necessarily target users directly, but it could use compromised sites to spread malware and steal other valuable data.<\/p>\n
If you\u2019re feeling extra cautious, check the social accounts of sites and services you frequently use to see if they\u2019ve posted any updates before visiting.If you have a website, even a simple blog, it\u2019s time to check what version of PHP your site uses, if any. If you\u2019re using a service like Squarespace or Wix, you\u2019re in the clear, as those don\u2019t support PHP.Customers of Hostinger, GoDaddy, Bluehost, or other web hosting services should be more cautious. GoDaddy says that any site using PHP should assume it is affected and update to the fixed release as soon as possible. It also says that sites running PHP 8.1 or older should upgrade to a newer version, as they\u2019re no longer supported and there will not be an official fix coming.Those on a managed hosting service should check with their provider to see when they should expect the fix to be deployed.<\/p>\n
If you sell products or services or have any sensitive data on your servers at all, it\u2019s best to disable your site until your host patches their version of PHP.Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.Terrence O’BrienJay PetersNewsSecurityTechMost PopularThe iPhone Duo is a messy, expensive, good timeA critical PHP vulnerability may take websites down todayEA is shutting down BioWareThe Gospel according to Peter (Thiel)Can you see everything?Advertiser Content FromThis is the title for the native ad<\/p>\n","protected":false},"excerpt":{"rendered":"
TechNewsSecurityPHP: The three letters that shut down sites all over the internet todayOpenAI is taking credit for finding the PHP2Shell vulnerabilities, but now someone has to apply all these patches,OpenAI is taking credit for finding\u2026<\/p>\n","protected":false},"author":1,"featured_media":30197,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-30196","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/demo.tcjhomeaccents.com\/wp\/wp-json\/wp\/v2\/posts\/30196","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/demo.tcjhomeaccents.com\/wp\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/demo.tcjhomeaccents.com\/wp\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/demo.tcjhomeaccents.com\/wp\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/demo.tcjhomeaccents.com\/wp\/wp-json\/wp\/v2\/comments?post=30196"}],"version-history":[{"count":0,"href":"https:\/\/demo.tcjhomeaccents.com\/wp\/wp-json\/wp\/v2\/posts\/30196\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/demo.tcjhomeaccents.com\/wp\/wp-json\/wp\/v2\/media\/30197"}],"wp:attachment":[{"href":"https:\/\/demo.tcjhomeaccents.com\/wp\/wp-json\/wp\/v2\/media?parent=30196"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/demo.tcjhomeaccents.com\/wp\/wp-json\/wp\/v2\/categories?post=30196"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/demo.tcjhomeaccents.com\/wp\/wp-json\/wp\/v2\/tags?post=30196"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}