A hidden flaw in a common web tool knocked many sites offline
A serious flaw in PHP, a programming language that runs behind many websites, caused outages on October 21, 2026. Sites affected included 4chan, DeviantArt, several Wikimedia services and others. Two related flaws, CVE-2026-109618 and CVE-2026-109619, both scored 9.2 out of 10 for severity. The PHP Group said they could let an attacker run their own code on a server, without a password. The attacker could then change content and read stored site data.
PHP works a bit like the kitchen behind a restaurant. Customers never see it, but it prepares what they are served. Each visitor's request gets its own workspace inside that kitchen.
The first flaw happens when the kitchen runs out of room. PHP can stop partway through setting up a request. Its cleanup step may then treat that unfinished setup as complete. The second flaw is about leftovers. Some information from one request can remain after its workspace is cleared. The next request handled by the same worker may pick up that old information before it is reset. Both descriptions come from the PHP project's security advisories.
The reach is wide. VirusTotal said its scanner found about 3.8 million sites running PHP with at least one open port. W3Techs estimates that PHP is used by 69.3 percent of websites whose server language it can identify.
The nickname "php2shell" comes from details that leaked before the official fix. The PHP project had scheduled a critical update for 14:00 UTC on October 21. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP.net homepage urges users to update now. CERT-EU also published a warning.
Wiz, a security firm owned by Google, says it found and reported the flaws using AI. It says they had been in PHP for about 20 years. Exploiting them used to require a very long chain of steps, close to what human researchers could practically manage. Wiz says powerful AI models made them much easier to use in attacks. OpenAI said an AI security group called Calif found a serious PHP flaw using its GPT-5.6 Sol model. OpenAI called it "one of the most impactful security issues in recent memory". The PHP Foundation said an attack on one of the flaws had been considered in 2024, but no practical method was found then.
Government agencies gave practical advice. The NSA's Cybersecurity account on X recommended taking systems offline if an update could not be installed right away. The UK's National Cyber Security Centre gave the same advice. Some Dutch and Finnish government agencies shut their websites as a precaution.
For visitors, the outages looked like sudden maintenance. The BBC reported that websites went down worldwide over a serious cyber-security issue. DeviantArt said it was "temporarily down for maintenance" and gave no reason. Wikimedia published a blog post on October 21 about its own tools. Kotaku reported that Pokémon Home and Pokémon Champions also went offline.
Wikipedia had a different outage in May. The Wikimedia Foundation blamed heavy traffic, including millions of automated data requests from "rogue" OpenAI agents, according to The Independent.
In my view, the main lesson is about speed. A flaw that sat in widely used software for about 20 years went from being reported to a public description, a fix and shutdown advice in one day. Organizations that expect weeks between a warning and an attack will find that harder to rely on. Being able to take a site offline quickly is becoming a basic requirement.
The broader context here is that the same AI tools that make these flaws easier to exploit also helped find them. The fixes reached users on the same day the sites went dark. That gap is far shorter than the two decades the flaws reportedly went unnoticed.
