Websites and online services worldwide are under growing threat after two critical vulnerabilities were disclosed in PHP, the programming language behind much of the web, including sites built on WordPress, which powers around 40% of websites globally.

The flaws could allow attackers to execute code remotely without logging in, potentially letting them take over servers, alter site content and reach databases, passwords and API keys. Cloudflare's chief technology officer reported seeing early signs of attacks.

The first flaw, tracked as CVE-2026-109618, stems from how PHP handles memory when it runs out, while the second, CVE-2026-109619, involves internal data lingering after its associated memory has been freed. One of the bugs has existed in PHP for roughly two decades, but exploiting it previously required a complex chain of technical steps.

Artificial intelligence played a role in uncovering the issues. OpenAI said a security research group known as Calif identified one of the problems using its GPT-5.6 Sol model, while Google-owned security firm Wiz independently discovered and reported the flaws. Wiz described them as among the most serious vulnerabilities in software history.

VirusTotal has detected about 3.8 million sites running PHP with at least one open port. The fallout has reached platforms including Wikipedia and DeviantArt, and government bodies in the Netherlands and Finland have taken some of their sites offline as a precaution. US and British security agencies have advised shutting down affected systems if patches cannot be applied immediately.

GoDaddy urged site owners to assume any PHP site is affected until it has been checked and updated. PHP 8.1 and earlier versions are no longer supported, making an upgrade to a newer release essential.