Websites go offline as PHP patches two critical vulnerabilities rated 9.2 out of 10
In short
The PHP Foundation released security patches at about 10 a.m. ET for two critical vulnerabilities in the PHP programming language, each rated 9.2 out of 10. US, European and British authorities recommended that sites that cannot update immediately go offline, and a number of websites, including parts of Wikipedia, 4chan and some government sites, did so.
Read the full story 2 min read
The PHP security team released patches at about 10 a.m. ET to fix two vulnerabilities in the PHP programming language, according to NBC News and The Verge. Each carries a severity rating of 9.2 out of 10. NBC News reported that US, European and British authorities recommended that websites temporarily go offline until they can be fixed. The Verge, citing cybersecurity firm watchTowr, said the flaws are remote code execution exploits that could let attackers run their own code on affected servers. [ 2 , 3 ]
The PHP Foundation detailed the vulnerabilities as CVE-2026-109618 and CVE-2026-109619, which it said affect all PHP installations serving web requests going back to PHP version 5. Wired reported that only PHP 8.2 and newer are still supported and will receive patches, although some distributions and third-party vendors still produce legacy fixes. CNET, by contrast, said older sunsetted versions are also getting an emergency update. Newsweek, citing Google Cloud, said PHP 5.4 through 8.5.11 are affected, with fixes in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP Foundation wrote that there are no complete mitigations and that updating is the only safe choice. [ 4 , 5 , 8 ]
Several websites went offline. NBC News named Pinboard and some parts of Wikipedia, as well as 4Chan and Something Awful, and said Japanese websites were also voluntarily offline. GOG said at 8 a.m. Pacific that its site and launcher would be offline for a couple of hours, and PC Gamer reported it was back roughly four hours after going down. PC Gamer also reported that the government of Finland took down websites. Engadget, citing Reuters, said governments in the Netherlands, Denmark, France and Finland took down at least some websites, and that Canada's Minister of Artificial Intelligence and Digital Innovation, Evan Solomon, posted on X about going offline temporarily. [ 3 , 7 , 10 ]
The US National Security Agency Cybersecurity Division said on X that if an immediate update is not feasible, organizations should take the system offline until it can be fully mitigated. The EU Computer Emergency Response Team and the UK National Cyber Security Centre issued advisories with similar advice. Engadget said the main US government response so far was a message from the Cybersecurity and Infrastructure Security Agency encouraging organizations to update. Cloudflare said it was seeing early attacks emerging, and its chief technology officer said it had deployed a fix to its firewall. watchTowr said it was observing in-the-wild exploitation but that nobody had been successful to date. [ 2 , 4 , 5 , 8 , 10 ]
The scale of exposure is not settled. NBC News cited W3Techs as saying PHP is used in 69% of all websites and Censys as counting nearly 55 million web properties running PHP, and said it was unclear how many had applied the update. One researcher estimated more than 1.3 million internet-connected hosts are likely affected, according to The Verge. Wordfence warned that the fix cannot be installed by automatic updates. OpenAI said it helped discover the vulnerability, while CNET reported OpenAI saying the hacker team Calif found it using GPT-5.6 Sol and that Wiz identified it independently. [ 2 , 3 , 5 ]
Why it matters
PHP is used in about 69% of all websites, according to W3Techs as cited by NBC News, so the flaws could affect a very large number of sites. Outlets report that it is not yet known how many sites have applied the update or were compromised before patching.
Key facts
- Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each carry a CVSS v4.0 severity rating of 9.2, Newsweek reported. [ 8 ]
- The PHP security patches were released around 10 a.m. ET. [ 2 , 3 ]
- Google Cloud said PHP 5.4 through 8.5.11 are affected, with fixes in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. [ 8 ]
- The US NSA Cybersecurity Division said organizations should take systems offline if an immediate update is not feasible. [ 8 ]
- The EU Computer Emergency Response Team and the UK National Cyber Security Centre advised companies that cannot patch immediately to isolate internet-facing apps or take them offline. [ 2 ]
- Pinboard, some parts of Wikipedia, 4Chan and Something Awful went offline, NBC News reported. [ 3 ]
- Governments in the Netherlands, Denmark, France and Finland took down at least some websites as a precaution, Engadget said, citing Reuters. [ 10 ]
- OpenAI said it helped discover the vulnerability and brought it to PHP's attention. [ 3 ]
Confirmed by several sources
- Patches for the two PHP vulnerabilities were released around 10 a.m. ET. [ 2 , 3 , 5 ]
- The two vulnerabilities are rated 9.2 out of 10 in severity. [ 2 , 5 , 8 ]
- The vulnerabilities allow attackers to run their own code on affected web servers. [ 2 , 5 ]
- Authorities including the UK National Cyber Security Centre recommended that websites that cannot patch immediately be taken offline. [ 2 , 5 ]
- A number of websites went offline as a precaution, including parts of Wikipedia, 4chan and GOG. [ 3 , 7 , 9 ]
- The government of Finland took down websites as a precaution. [ 7 , 10 ]
- AI tools were involved in discovering the vulnerabilities. [ 3 , 5 , 8 , 9 , 10 ]
Still unclear
- How many websites have applied the update and how many were hacked before patching. NBC News said it was unclear how many properties had applied the update and that it could be days before it is clear how many sites were hacked.
- How many sites are vulnerable. Estimates differ: one researcher estimated more than 1.3 million hosts, Censys counted nearly 55 million web properties running PHP, and Newsweek noted that PHP's roughly 70 percent share of websites does not mean 70 percent are vulnerable.
- Which PHP versions will receive fixes. Wired reported that only PHP 8.2 and newer are supported and will receive patches, while CNET said older sunsetted versions are also getting an emergency update.
- Who discovered the vulnerabilities. OpenAI said it helped discover them (NBC News); CNET reported OpenAI saying the hacker team Calif found them with GPT-5.6 Sol and Wiz identified them independently; Newsweek reported Google Cloud saying Wiz Research used several AI models.
- Whether attacks have succeeded. watchTowr said it observed in-the-wild exploitation but that nobody had been successful to date; Cloudflare said it was seeing early attacks emerging. Neither claim is confirmed by other documents.
- When the White House learned of the issue. Engadget said the White House told Reuters it was made aware on Friday; no other document gives this.
What local media are saying
Timeline, local time
- GOG announced its site and launcher would be offline for a couple of hours (Pacific time, per PC Gamer). [ 7 ]
- PHP security patches released (ET). [ 2 , 3 , 5 ]
- PC Gamer reported that GOG was back online roughly four hours after it was taken offline. [ 7 ]
- Engadget reported that government websites in the EU and Canada had been taken offline as a precaution. [ 10 ]