Two critical vulnerabilities in the PHP programming language, which powers about 70% of websites, prompted a coordinated global response this week, with many sites going offline or scaling back services to avoid potential cyberattacks. The PHP Foundation announced the update on Tuesday, and the security team gave advance notice of the release, urging users to prepare.
What happened and which sites were affected
The PHP security team posted on X (formerly Twitter) that the upcoming security release on Wednesday at 14:00 UTC would address two critical vulnerabilities, both rated CVSSv4 9.2. Security agencies worldwide, from the UK and the US to China and Japan, called on websites to go dark if they couldn't update immediately, fearing cyber-attacks.
Several major sites and services were affected, including some UK government services, 4Chan, Wikimedia (which runs Wikipedia), DeviantArt, the Dutch Parliament, the Dutch football association KNVB, the Dutch National Cyber Security Centre, the Port of Rotterdam, Belgian foreign ministry websites, the Belgian primary school platform Smartschool, Finnish public web services, French government web portals, OpenStreetMap's wiki, the game Umamusume: Pretty Derby, the art community Fur Affinity, the bookmarking service Pinboard, and the wiki hosting service Miraheze.
What are the vulnerabilities?
The two flaws are identified as CVE-2026-109618, which made PHP's memory handling shoddy, and CVE-2026-109619, an error that made the software confuse its requests. Together, they could let anyone run malicious code on a server without logging in, potentially to steal data or deface sites. Cybersecurity professionals are calling the pair 'PHP2Shell'.
The bugs were discovered by Calif, an American company that tests AI models to see if they can identify cyberattacks. OpenAI, which is behind ChatGPT, said in a blog post that the bugs are 'one of the most impactful security issues in recent memory'. Wiz, a Google-owned security company that also found the holes, described them as 'severe'.
Cybersecurity researchers say they've spotted 'millions' of hackers in the wild trying to break into websites that haven't updated yet. The Internet Archive, a tech nonprofit, said it was 'attacked' but is now up and running again.
Should regular users be worried?
Experts say there's no immediate cause for panic. 'You can't catch this bug by browsing,' says Shahak Shalev, global head of scam and AI research at the cyber firm Malwarebytes. 'The danger is that attackers get to hide behind sites you already trust.' A hacked shopping website's checkout page could be edited to skim credit card information, Shalev adds.
But there's still no definite proof these PHP holes have been exploited, says Voldemaras Kadys, head of security and platform engineering at the digital media house Mediatech. 'There's no reason to stop browsing or shopping online,' Kadys says. 'But users should still be extra cautious about suspicious messages because we don't know what kind of data hackers may have stolen through this vulnerability, and from which websites.'
Julie Nicholson, director of cyber resilience at the IT company Advania UK, says there's nothing for individuals to install themselves. 'There's no need to panic and nothing to install yourself,' she says. 'The job sits with the organisations running the sites.' She adds that such incidents are good reminders to use unique passwords, enable two-factor authentication, and be wary of spam emails and texts.
