Last week governments, banks, airlines, and websites went offline around the world after the maintainers of PHP, a programming language behind much of the internet, rushed out fixes for two critical security flaws. OnlyFans was among the sites users reported down that day. OnlyFans hasn’t said publicly what caused it, but given the timing, the PHP vulnerability makes the most sense.
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, could let attackers run code on a web server without logging in. PHP quietly powers WordPress, Drupal, Joomla, and Magento sites, along with hosting platforms and plenty of software that you would never guess. Wiz estimates roughly 70 percent of the internet is affected, while W3Techs puts PHP at about 75 percent of sites whose server-side language can be identified.
How exactly did everyone find out about this PHP vulnerability? AI found it first. Researchers at the security firms Calif and Wiz uncovered the flaws, which had gone undetected for more than a decade. Calif and the PHP Foundation were part of an OpenAI program called Patch the Planet, which gave them advanced AI tools. OpenAI called the issue “one of the most impactful security issues in recent memory.” Details leaked on social media the day before the fix, forcing an early announcement.
The response was dramatic but likely necessary. The NSA, CISA, Britain’s NCSC, EU cybersecurity agencies, and counterparts in Canada and Australia all urged organizations to patch immediately, and several advised taking systems offline if they couldn’t. Finland shut down government public web services, and Dutch agencies pulled their sites. Wikipedia took some systems down, while some BBC program pages and Edinburgh’s council site also went offline, though like OnlyFans, neither confirmed a PHP link. In Japan, Nomura, Mitsubishi UFJ, ANA, and East Japan Railway suspended some services, and Nintendo and French telecom group Orange also acted. An outage tracker listed 741 sites that went offline, though it cautions that being listed doesn’t mean a site was compromised. Most went down as a precaution.
The threat was very real. Cloudflare CEO Matthew Prince said the company saw thousands of exploitation attempts in the ten hours before the announcement, tens of thousands in the 45 minutes after, hundreds of thousands within two hours, and millions soon after. Palo Alto Networks’ Unit 42 reported attackers using agentic AI tools after exploitation. In one case against a European government entity, they reached password hashes and multi-factor authentication secrets within two hours. As of CISA’s alert, the agency hadn’t observed successful exploitation in the wild.
But when sites like OnlyFans go down, it is a problem not just for the users. Creators have the most at stake in this situation, because downtime means paused income and interrupted messages. But that’s better than a breach, which could expose emails, addresses, and payment details. If creators are still worried, they should ask the websites that hold their data whether they’ve applied the fix, then update their devices, change passwords and avoid reusing them. It’s also important to turn on two-factor authentication, and ignore emails urging you to install software or verify an account unless you can confirm they’re real.