What is PHP? Why two critical flaws knocked sites offline across the internet

If you tried to visit Wikipedia, 4chan or DeviantArt on Wednesday and hit an error, you weren’t alone, and that’s why so many Americans typed “what is php” into Google. Two critical security flaws in PHP, the programming language behind a huge share of the web, led sites and services around the world to go offline as a precaution on Oct. 21, The Verge reported. The search drew more than 50,000 US queries on Google Trends, along with “php vulnerability 2026,” “websites down” and the two bug IDs, CVE-2026-109618 and CVE-2026-109619.

What is PHP?

PHP (it stands for PHP: Hypertext Preprocessor) is a server-side scripting language for building websites. It runs on the web server, builds pages, talks to databases and handles back-end logic before your browser ever sees the finished HTML, as the UK’s National Cyber Security Centre (NCSC) describes it.

It’s everywhere. The survey service W3Techs says PHP is used by 69.3% of websites whose server-side language it can identify, including Wikipedia and any site built on WordPress, according to The Verge. VirusTotal’s scanner registers about 3.8 million sites running PHP with at least one port open, the outlet added.

What went wrong: the two PHP vulnerabilities

The PHP Group published an advisory on Oct. 21 describing two flaws that can allow unauthenticated remote code execution, meaning an attacker could run their own code on a server without logging in:

• CVE-2026-109618, “RCE via OOM corruption”: out-of-memory handling can interrupt PHP while internal request data is only partly set up, and cleanup may then treat the bad data as valid.
• CVE-2026-109619, “RCE via stale global state”: internal state tied to one request can survive after its memory has been freed, and a later request on the same worker may use it.

The PHP Group says the risk covers all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It considers mod_php the highest risk, with a demonstrated exploit that can trigger before any application code runs.

How serious is it?

Very, according to the people involved. The Verge reported that OpenAI called it “one of the most impactful security issues in recent memory,” and security firm Wiz called it “among the most severe vulnerabilities discovered … in software history.” Cloudflare’s CTO said the company was “seeing early attacks emerging,” per The Verge.

The bug has existed in PHP for about 20 years, The Verge reported, but Wiz said exploiting it once required “an exceptionally complex chain of steps.” AI changed that: OpenAI said an AI security group called Calif found a critical flaw using one of its models, and Wiz independently found and reported the bugs using AI, The Verge said. Those are the companies’ own accounts.

Why websites went down

Because patching takes time, officials told organizations that couldn’t update right away to consider pulling systems offline. The NSA’s cybersecurity account on X and the UK’s NCSC both made that recommendation, The Verge reported. Some Dutch and Finnish government agencies took sites down as a precaution, and Pokémon Home and Pokémon Champions were also taken offline, The Verge said, citing Kotaku.

The PHP patch: which versions fix it

According to the PHP Group, the fixed releases are:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

Linux distributions and long-term-support vendors got the patches in advance, so check your vendor for updated packages. PHP 8.1 and older no longer get official updates; the PHP security team said it provided minimal source backports for 7.4, 8.0 and 8.1, and some vendors offer their own fixes.

What should you do?

If you’re just browsing: not much, The Verge said. The flaws affect servers, not your device directly, though compromised sites could be used to spread malware. If a site you use is down, check its social accounts for updates.

If you run a website: find out which PHP version it uses. The Verge noted that hosted builders like Squarespace and Wix don’t support PHP. If you’re on Hostinger, GoDaddy, Bluehost or similar hosts, check with your provider; GoDaddy told customers to assume any PHP site is affected and to update as soon as possible. The NCSC advises organizations to update, apply the PHP team’s hardening steps or temporary mitigations, consider taking systems offline if they can’t, and check for signs of compromise.

FAQ

What is PHP used for? Building dynamic websites, including WordPress sites.

What are CVE-2026-109618 and CVE-2026-109619? Two critical PHP flaws disclosed Oct. 21, 2026, that can allow remote code execution.

Is there a fix? Yes: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Earlier coverage: PHP vulnerability: Critical 'php2shell' flaws patched; update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (Oct 21)