AI-found PHP2Shell flaws push governments and companies to take websites offline

Two critical flaws in PHP, the programming language behind an estimated 70% of websites including WordPress and Drupal, were disclosed on 21 October after the PHP project released fixes. The bugs, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, are rated 9.2 out of 10 and can allow remote code execution on unpatched sites.Sources:1CNN (via ABC7 New York): Some websites shut down globally as operators address PHP issue after AI finds critical flaw, CNN (via ABC7 New York), 22 October 2026 (source, opens in a new tab)2The Record (Recorded Future News): Hundreds of websites taken offline as concern grows over two PHP vulnerabilities, The Record (Recorded Future News), 21 October 2026 (source, opens in a new tab)

Researchers at OpenAI, Google-owned Wiz and the security firm Calif found the bugs in late August. OpenAI said frontier AI found the vulnerabilities before attackers did, while Wiz called the episode an "AI inflection point" and said AI let a single researcher do in a week what would have taken a world-class team months.Sources:1CNN (via ABC7 New York): Some websites shut down globally as operators address PHP issue after AI finds critical flaw, CNN (via ABC7 New York), 22 October 2026 (source, opens in a new tab)2The Record (Recorded Future News): Hundreds of websites taken offline as concern grows over two PHP vulnerabilities, The Record (Recorded Future News), 21 October 2026 (source, opens in a new tab)4Axios: Black October: why bugs discovered by OpenAI tech are creating a cyber emergency, Axios, 22 October 2026 (source, opens in a new tab)

Government websites in France, Denmark, Finland and the Netherlands went offline during fixes, including the Dutch cybersecurity agency's own site. In Japan, ANA, JR West and MUFG suspended some pages or services, and Prime Minister Sanae Takaichi urged operators to check whether their public websites use PHP. The Wikimedia Foundation took several systems down as a precaution.Sources:1CNN (via ABC7 New York): Some websites shut down globally as operators address PHP issue after AI finds critical flaw, CNN (via ABC7 New York), 22 October 2026 (source, opens in a new tab)

The US National Security Agency, CERT-EU, the UK's National Cyber Security Centre and Germany's BSI issued warnings, and CISA urged immediate updates to the patched PHP versions. Amazon said it saw a first exploitation attempt on 17 October while the flaws were still under embargo and that PHP2Shell is now broadly exploited in the wild; watchTowr said none of the circulating public exploits had yet achieved remote code execution.Sources:2The Record (Recorded Future News): Hundreds of websites taken offline as concern grows over two PHP vulnerabilities, The Record (Recorded Future News), 21 October 2026 (source, opens in a new tab)3SecurityWeek: PHP2Shell Exploitation Started Days Before Patches, SecurityWeek, 22 October 2026 (source, opens in a new tab)

Cloudflare, which worked with the PHP Foundation and the researchers, said attack attempts rose from thousands to millions after the announcement. Security firms estimated that more than 1 million PHP servers were still unpatched as of 21 October.Sources:1CNN (via ABC7 New York): Some websites shut down globally as operators address PHP issue after AI finds critical flaw, CNN (via ABC7 New York), 22 October 2026 (source, opens in a new tab)3SecurityWeek: PHP2Shell Exploitation Started Days Before Patches, SecurityWeek, 22 October 2026 (source, opens in a new tab)