Major websites including Wikipedia, the Steam store, and various government portals went offline on October 21, 2026, after OpenAI's AI model helped uncover critical security flaws in PHP. These vulnerabilities, known as PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution on web servers. They threaten millions of systems worldwide, since PHP powers roughly 70 percent of websites.

Ck75xq2lmno5zbqdena5ii6h6e

Security firm Calif discovered one of the flaws in August using OpenAI's GPT-5.6 Sol model as part of the company's Patch the Planet initiative. OpenAI's team independently found a more complete version in September, while cloud security firm Wiz reported both issues on its own. The bugs had existed in PHP for about 14 years. A limited version appeared in 2024 but was not treated as serious at the time. OpenAI coordinated a two-month response with PHP maintainers, Wiz, Cloudflare, and others to prepare fixes before public disclosure.

Details leaked early, forcing PHP to release emergency patches on October 21 in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The flaws sit in core request handling and can let an attacker run code on a server without logging in, potentially before any application code executes in some setups. Older unsupported PHP versions receive only limited backports.

Widespread outages followed as operators took systems offline as a precaution:

  • Wikipedia and other Wikimedia services went down, with the foundation confirming the downtime related to the PHP issues.
  • The Steam store became unavailable, though game downloads and library features largely continued working.
  • Government websites in Finland, the Netherlands, and France were taken offline, along with some other public services. Agencies including the US National Security Agency and European counterparts advised organizations to patch immediately or isolate systems from the internet if they could not update right away.

Cloudflare reported early attack traffic, and some security firms observed exploitation attempts. OpenAI described the bugs as among the most impactful security issues in recent memory and noted that AI can now find vulnerabilities with internet-scale effects. Site operators continue installing the patches, with many services expected to return once updates are complete and verified. Visitors should watch for unexpected behavior on familiar sites while the response continues.