AI-Discovered PHP Vulnerabilities Trigger Global Website Shutdowns

The PHP Foundation released emergency security updates on October 21, 2026, to address two critical zero-day vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively dubbed "PHP2Shell." Rated 9.2 on the CVSS v4.0 scale, the flaws allow unauthenticated remote code execution, potentially granting attackers direct access to server file systems and databases. Because PHP powers approximately 70% of the internet, the vulnerabilities posed a systemic risk to millions of hosts, including WordPress and Drupal sites.

The flaws were discovered using advanced AI models, including OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon, through a coalition involving security firms Wiz and Calif. While a coordinated disclosure was planned for October 22, a social media leak forced the patches to be released a day early. Cloudflare CEO Matthew Prince reported that exploitation attempts surged from thousands before the announcement to millions shortly after, while Amazon detected early attempts as early as October 17.

In response, governments in the United States, United Kingdom, Japan, Canada, Finland, France, the Netherlands, and Belgium urged immediate patching or the temporary suspension of services. Precautionary shutdowns affected the Dutch House of Representatives, the Finnish government, the BBC, and the Wikimedia Foundation, as well as various local councils in the UK. The U.S. National Security Agency and FBI mandated immediate patching across federal agencies, while the White House framed the AI-driven discovery as a victory for American innovation in national security.