PHP Vulnerabilities Prompt Website Disruptions and Precautionary Shutdowns
Two critical vulnerabilities in PHP, a programming language used by many websites, have prompted disruptions and precautionary shutdowns. The report identifies 4chan, DeviantArt and Wikipedia among affected sites. Some Dutch and Finnish government agencies took websites offline, while Pokémon Home and Pokémon Champions reportedly went offline. US and UK cybersecurity agencies advised organizations to take vulnerable systems offline if immediate updates were not feasible.
The flaws, designated CVE-2026-109618 and CVE-2026-109619, could let attackers run code on servers without logging in. One involves errors in handling partially initialized data when memory runs out; the other involves internal data surviving after its memory has been freed. Successful exploitation could expose stored information or allow changes to website content.
According to the report, the underlying weakness existed for roughly 20 years but was exceptionally difficult to exploit. Researchers at Calif and security firm Wiz independently used AI tools to identify attack methods. The PHP Foundation said an exploit had been theorized in 2024, but no concrete method was identified then. Cloudflare reported signs of early attacks after disclosure.
The potential reach is substantial. W3Techs estimates that PHP is used by 69.3 percent of websites with a known server-side programming language. That figure does not mean every PHP site has been compromised.
Ordinary users cannot install server-side fixes themselves. The report says the vulnerabilities affect servers rather than directly targeting individual visitors’ personal devices. Website owners should check whether their sites use PHP, update to a patched and supported release, and ask managed hosting providers when fixes will be deployed. Sites using unsupported PHP versions may need to upgrade before an official patch is available. Operators holding sensitive data may consider temporarily taking affected sites offline until they are patched. Visitors can consult service announcements to learn whether a website they use is affected.