AI-Discovered PHP Flaws Trigger Global Government Website Shutdowns

The PHP Foundation released emergency security patches on October 21, 2026, to address two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively dubbed "PHP2Shell." Rated 9.2 on the CVSS scale, the flaws allow unauthenticated remote code execution, granting attackers direct access to server file systems and databases. Because PHP powers approximately 70% of the internet, including WordPress and Drupal sites, the vulnerabilities posed a systemic risk to global digital infrastructure.

The flaws were discovered using frontier AI models, including OpenAI's GPT-5.6 Sol, by researchers at Wiz and Calif. While a coordinated disclosure was planned for October 22, a social media leak and an early fix release by Chainguard forced the PHP Foundation to accelerate the patch release. The foundation later admitted the vulnerabilities had existed for over a decade, attributing the delay in fixing them to a "structural failure" caused by resource shortages and decision paralysis.

In response, governments in the United Kingdom, Finland, France, the Netherlands, Japan, Canada, and Australia took numerous public services offline as a precaution. The U.S. National Security Agency and FBI issued urgent warnings to patch systems immediately or disconnect them from the internet. Cloudflare CEO Matthew Prince reported that exploitation attempts surged from thousands before the announcement to millions shortly after. While Amazon detected early attempts as far back as October 17, security agencies report no confirmed successful breaches of critical government systems.