Two AI-found PHP flaws took 4chan, DeviantArt and Wikimedia tools offline
Two critical PHP vulnerabilities, reportedly discovered with AI tooling, were behind major outages on October 21, 2026 at 4chan, DeviantArt, Wikimedia tools and services, and other sites. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and both are rated CVSS 9.2 on the 10-point severity scale. The PHP Group said they could enable unauthenticated remote code execution (RCE), which lets an attacker run their own code on a server without an administrator login or password. An attacker could then change content and access stored site data.
CVE-2026-109618 is described as "RCE via OOM corruption". OOM stands for out of memory. When PHP runs out of memory, it can be interrupted while a request's internal data is only partly set up. The cleanup routine may then treat that incomplete data as valid.
CVE-2026-109619 is described as "RCE via stale global state". Here, internal state tied to one request can survive after the memory behind it has been freed. A later request handled by the same worker process may use that leftover state before normal initialization resets it. Both descriptions come from the PHP project's security advisories.
The exposure is large. VirusTotal said its scanner registered about 3.8 million sites running PHP with at least one port open. W3Techs reports that PHP is used by 69.3 percent of all websites whose server-side programming language it can identify.
Details of the two flaws leaked before the official patch was released, which is where the name "php2shell" comes from. The PHP project had announced a critical security release for 14:00 UTC on October 21. Fixes are available in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP.net homepage carries an advisory urging users to update now. CERT-EU published its own advisory on the issues.
Wiz, which is owned by Google, says it independently discovered and reported the PHP vulnerabilities using AI. The firm says the flaws have existed in PHP for roughly 20 years, and that exploiting them previously required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Powerful AI models, Wiz says, have made such bugs much easier to weaponize. According to OpenAI, the AI security group Calif identified a critical PHP flaw using GPT-5.6 Sol. OpenAI called the issue "one of the most impactful security issues in recent memory", and Wiz described the vulnerabilities as "among the most severe vulnerabilities discovered in software history". The PHP Foundation said an exploit for one of the vulnerabilities had been theorized in 2024, but no concrete vectors were found, and other concrete issues overshadowed the concern.
Government agencies responded with operational guidance. The NSA Cybersecurity account on X recommended that organizations take their systems offline if an immediate update is not feasible. The UK's National Cyber Security Centre recommended taking affected systems offline. Some Dutch and Finnish government agencies took their websites down as a precaution.
On the consumer side, the BBC reported that websites were taken down worldwide over a critical cyber-security issue. DeviantArt said it was "temporarily down for maintenance" without specifying the reason. Wikimedia published a blog post on October 21 about the impact on its tools and services, and its Wikitech incident page describes critical maintenance work due to an updated PHP release, with events developing rapidly. Kotaku reported that Pokémon Home and Pokémon Champions were taken offline amid the PHP vulnerability issues.
Wikipedia had a separate outage in May, which the Wikimedia Foundation attributed to heavy traffic, including millions of automated data requests, from "rogue" OpenAI agents, according to The Independent.
In my view, the operational lesson is less about this one language than about timing. A flaw that reportedly sat in a widely deployed codebase for about 20 years moved from disclosure to a detailed public description, a patch and a set of takedown recommendations within a single day. Operators whose patch pipelines assume weeks of quiet between advisory and exploit will find that assumption harder to defend. The ability to pull a service offline on short notice is becoming an engineering requirement rather than a contingency plan.
The broader context here is that the same tooling that lowered the cost of weaponizing these bugs also helped locate them. The fixed releases reached operators on the same day the affected sites went dark. For a codebase that powers a large share of the web, that is a narrower gap than the two decades the flaws reportedly went unnoticed.
