A pair of severe vulnerabilities in the PHP programming language have caused widespread internet disruptions, leading to the temporary shutdown of sites like Wikipedia, WordPress, and even Pokémon Home. The flaws, discovered by AI-assisted security researchers, allow for remote code execution without requiring administrator credentials. The PHP Foundation confirmed the risks, warning that any site running PHP is vulnerable. The vulnerabilities, labeled CVE-2026-109618 and CVE-2026-109619, exploit memory management and state handling issues in PHP's internal processes. These bugs have been present for over two decades but were previously too complex to exploit effectively. However, advancements in AI have made it easier to turn these obscure flaws into real-world threats. The U.S. and UK cybersecurity agencies have recommended taking systems offline until patches are applied, highlighting the severity of the issue. The PHP community is now under pressure to deploy fixes quickly, as the vulnerabilities could allow attackers to take full control of servers, access sensitive data, and spread malware through compromised sites.
October 21, 2026
PHP Vulnerabilities Trigger Global Website Outages
Two critical PHP vulnerabilities have forced major websites and government systems to go offline, prompting urgent security updates.
Impact
The widespread outage underscores the critical role of PHP in internet infrastructure and the urgent need for immediate patching to prevent further breaches and data loss.