Two bugs discovered with the help of AI are behind major disruptions today for 4chan, DeviantArt, Wikipedia, and countless smaller sites. These "critical vulnerabilities" were found in the PHP programming language, which underpins approximately 69.3 percent of the internet, including any site built on WordPress.
The AI Breakthrough in Vulnerability Research
According to OpenAI, a security group called Calif identified a flaw using GPT-5.6 Sol, while Google-owned Wiz independently discovered the issues using AI. While these bugs have been present in PHP for roughly 20 years, security firm Wiz noted that exploiting them previously required a chain of steps so complex it was at the edge of human capability. Powerful AI models have now made it trivial to weaponize these obscure bugs.
Technical Impact: RCE and Data Exposure
The PHP Group states that hackers could use these vulnerabilities for "unauthenticated remote code execution" (RCE), allowing them to run code, change content, and access stored data without admin credentials. The two specific CVEs are:
- CVE-2026-109618: RCE via out-of-memory (OOM) corruption, where interrupted data initialization leads to security bypasses.
- CVE-2026-109619: RCE via stale global state, where memory from previous requests is improperly reused.
Cloudflare’s CTO reported seeing "early attacks emerging" as of last night. Government agencies in the Netherlands and Finland have taken sites offline as a precaution, following recommendations from the NSA and the UK’s National Cyber Security Center.
What Website Owners Need to Do
The PHP Group warns that basically any site running PHP is at risk. While users of Squarespace or Wix are safe (as they do not support PHP), those using GoDaddy, Hostinger, or Bluehost must check their PHP versions immediately. Sites running PHP 8.1 or older are particularly vulnerable as they are no longer supported and will not receive an official patch.
