Global organizations scrambled to update web servers on October 21 and 22, 2026, after artificial intelligence tools helped uncover two critical memory-corruption vulnerabilities in PHP, the programming language that powers roughly 70 percent of websites worldwide. The emergency prompted widespread preventive website shutdowns from Europe to Asia.
The discovery of the flaws—collectively designated as PHP2Shell and tracked under CVE-2026-109618 and CVE-2026-109619—exposed deep architectural risks in software that has quietly run a vast portion of internet infrastructure for decades. Created in the early 1990s, PHP executes server-side logic, interacting with databases and generating dynamic HTML for content management systems like WordPress, major online stores, and public administration portals.
PHP 8.5.12 released – 90 fixes in 29 components, including security fixes (CVE-2026-109618, CVE-2026-109619).Changelog + downloads: https://t.co/q5agMkUfNe
Security researchers from Wiz utilized advanced models including Google’s Gemini 4 Argon, Wiz Atlas, and OpenAI’s GPT-5.6 Sol to unearth the flaws. Artificial intelligence changed the equation by rapidly transforming a long-standing weakness into a functional exploit, according to investigators.
Exploitation Attempts Flood Cloudflare Networks
The public disclosure of the vulnerabilities triggered an immediate digital scramble. Cloudflare, a US cybersecurity and online content distribution company, reported in the early hours of Thursday that millions of attack attempts occurred following the disclosure of the vulnerabilities, observing thousands of attempts to exploit them in the 10 hours prior to the public announcement.
Governments and Public Agencies Take Critical Portals Offline
Faced with the prospect of unauthenticated remote code execution, governments and enterprise operators across multiple continents chose radical preventive isolation. In the Netherlands, authorities pulled critical public portals offline, including Overheid.nl, MijnOverheid.nl, and DigiD, while European institutions in France, Denmark, and Finland instituted similar temporary shutdowns.
In the United Kingdom, government experts worked around the clock in close collaboration with OpenAI and international partners. Meanwhile, Sanae Takaichi issued urgent instructions via social media advising administrators to verify their PHP setups and install patches immediately, noting that temporary website suspension should be considered if patching proved difficult.
The PHP Foundation Issues Emergency Patches Across Active Branches
The PHP Foundation, which has maintained the open-source language since 2021, responded by publishing emergency software updates covering active branches. Administrators running vulnerable servers were directed to update immediately to PHP versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Cybersecurity agencies, including the FBI’s cyber division and the NSA Cyber, backed the guidance, reiterating that systems unable to take patches promptly should be severed from public networks.
Despite the high alert, officials emphasized that the widespread outages stemmed from defensive disconnection rather than active data breaches. Valtori general manager Hannu Naumanen noted in a statement that restoring systems would take days or weeks due to the rigorous testing required for enterprise updates.
Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially… pic.twitter.com/tnwiQv5v0F
During the unfolding crisis, international security bodies worked in close concert. James Sullivan, of the Royal United Services Institute in London, explained that the critical memory corruption and unauthenticated remote access flaws left servers exposed to potential takeover without requiring administrator passwords.
Financial and infrastructure exposures drew immediate warnings from market analysts. Nigel Green, chief executive officer of deVere Group, cautioned that online payment platforms, booking engines, digital markets, subscription portals, ticketing services, and delivery apps built on the language faced serious data exposure risks. In Colombia, ColCERT issued high-risk alert AL-20261021-123 after recording 8,699 exposed PHP services across the country.
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or…
