# AI-found PHP2Shell flaws push governments and companies to take websites offline

Technology · 22 October 2026 · Netherlands
URL: https://connectthedots.news/event/2026-10-22-ai-found-php2shell-flaws-push-governments-and-companies-to-take

> Two critical PHP flaws found with AI help led governments, banks and Wikipedia to pull sites offline while attackers began probing unpatched servers.

Two critical flaws in PHP, the programming language behind an estimated 70% of websites including WordPress and Drupal, were disclosed on 21 October after the PHP project released fixes. The bugs, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, are rated 9.2 out of 10 and can allow remote code execution on unpatched sites. [1][2]

Researchers at OpenAI, Google-owned Wiz and the security firm Calif found the bugs in late August. OpenAI said frontier AI found the vulnerabilities before attackers did, while Wiz called the episode an "AI inflection point" and said AI let a single researcher do in a week what would have taken a world-class team months. [1][2][4]

Government websites in France, Denmark, Finland and the Netherlands went offline during fixes, including the Dutch cybersecurity agency's own site. In Japan, ANA, JR West and MUFG suspended some pages or services, and Prime Minister Sanae Takaichi urged operators to check whether their public websites use PHP. The Wikimedia Foundation took several systems down as a precaution. [1]

The US National Security Agency, CERT-EU, the UK's National Cyber Security Centre and Germany's BSI issued warnings, and CISA urged immediate updates to the patched PHP versions. Amazon said it saw a first exploitation attempt on 17 October while the flaws were still under embargo and that PHP2Shell is now broadly exploited in the wild; watchTowr said none of the circulating public exploits had yet achieved remote code execution. [2][3]

Cloudflare, which worked with the PHP Foundation and the researchers, said attack attempts rose from thousands to millions after the announcement. Security firms estimated that more than 1 million PHP servers were still unpatched as of 21 October. [1][3]

## Who was involved

- [PHP Foundation](https://connectthedots.news/org/php-foundation): Issued the patches for the two PHP2Shell flaws [1]
- [OpenAI](https://connectthedots.news/org/openai): Its researchers helped find the flaws; said frontier AI found them before attackers did [1][2]
- [Wiz](https://connectthedots.news/org/wiz): Co-discovered the bugs and called the episode an "AI inflection point" [1]
- [National Security Agency](https://connectthedots.news/org/national-security-agency): Advised companies to act immediately on the two critical flaws [1][2]
- [Cloudflare](https://connectthedots.news/org/cloudflare): Worked with the PHP Foundation on the response; reported millions of attack attempts [1][3]
- [Sanae Takaichi](https://connectthedots.news/person/sanae-takaichi): Urged operators to check whether their public websites use PHP [1]

## Sources

1. CNN (via ABC7 New York), "Some websites shut down globally as operators address PHP issue after AI finds critical flaw", 22 October 2026: https://abc7ny.com/story/php-vulnerability-2026-websites-shut-down-globally-operators-address-ai-detected-flaw-web-programming-language/19968288/
2. The Record (Recorded Future News), "Hundreds of websites taken offline as concern grows over two PHP vulnerabilities", 21 October 2026: https://therecord.media/php-script-vulnerabilities-warnings
3. SecurityWeek, "PHP2Shell Exploitation Started Days Before Patches", 22 October 2026: https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/
4. Axios, "Black October: why bugs discovered by OpenAI tech are creating a cyber emergency", 22 October 2026: https://www.axios.com/2026/10/22/php-vulnerability-security-update-websites