AI-Discovered PHP Vulnerabilities Trigger Global Website Shutdowns

The PHP Foundation released emergency security updates on October 21, 2026, to address two critical zero-day vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively dubbed "PHP2Shell." Rated 9.2 on the CVSS v4.0 scale, the flaws allow unauthenticated remote code execution, granting attackers direct access to server file systems and databases. The vulnerabilities affected all versions from PHP 5 onward, potentially impacting up to 70% of the internet, including platforms like WordPress and Drupal.

Researchers at Calif and Wiz discovered the flaws in August using advanced AI models, including OpenAI's GPT-5.6 Sol. While a coordinated disclosure was planned for October 22, a social media leak forced the PHP Foundation to accelerate the patch release. The foundation later attributed the delay in fixing similar previous issues to a "structural failure" caused by a lack of resources.

In response, governments in the United Kingdom, Finland, France, the Netherlands, Belgium, Canada, and Japan took numerous public services offline as a precaution. High-profile entities including the BBC, Wikipedia, and the Pokémon Company also suspended services. The U.S. National Security Agency and FBI urged immediate patching, warning that the flaws provide a direct path to sensitive data. Cloudflare reported that exploitation attempts surged from thousands before the announcement to millions shortly after, while Amazon detected early attacks as early as October 17.