The discovery of two critical vulnerabilities in PHP — the venerable scripting language that quietly powers the majority of the web — has sent governments, enterprises, and infrastructure providers into a frantic race to patch exposed systems before attackers can weaponise flaws that have lain dormant for over a decade. Uncovered not by human auditors but by advanced AI models developed by OpenAI, the bugs — tracked as CVE-2026-109618 and CVE-2026-109619 — carry a severity rating of 9.2 out of 10 and affect PHP versions released across the last ten years. With an estimated 70% of global websites running on PHP, according to cyber-security firm Wiz, the potential blast radius is staggering. Yet, as of Friday, no successful exploits have been confirmed.
The Anatomy of php2shell
Researchers at Wiz and the cyber-security firm Calif, who collaborated on the disclosure, describe the vulnerabilities as inherent to the language’s core parsing logic. Under specific conditions, the flaws allow unauthenticated remote code execution, effectively handing an attacker the keys to the underlying web server. Ryan Austin, the Calif researcher who helped surface the issue, did not mince words: it is “the most serious vulnerability I’ve ever found.”
The moniker php2shell has already taken hold in security circles, a nod to the direct path the bugs provide from a malicious request to a system shell. Paul Spain, chief executive of Gorilla Cyber Security, warned the BBC that AI could now accelerate the development of reliable exploit chains, lowering the barrier for entry for threat actors. “We’re looking at millions and millions of potentially affected websites,” he estimated. Jill Slay, a cyber-security researcher at the University of Adelaide, characterised a weaponised campaign as “disastrous” for data privacy on a global scale.
A Patchwork Response Across Critical Infrastructure
The public alert on 21 October triggered immediate, visible disruption. The Wikimedia Foundation took multiple systems offline as a precaution. The Finnish government, Edinburgh Council, and the Dutch cyber-security agency all pulled public-facing portals. In the UK, 32 government sites were temporarily suspended, though officials stressed none were major citizen-facing services. France’s Orange telecommunications group suspended global services to deploy fixes. Perhaps most alarmingly, Japan’s SoftBank Corp disabled its emergency earthquake and tsunami alert system for mobile customers — a service not expected to resume until Monday — highlighting how deeply PHP is embedded in critical national infrastructure beyond traditional web serving.
The PHP Foundation released patches on Wednesday, urging immediate updates. The US National Security Agency went further, directing all organisations to take unpatched systems offline entirely, warning the flaws provide a “direct path” to database exploitation. Mirrored advisories followed from counterparts in the EU, Singapore, and Australia. Japanese Prime Minister Sanae Takaichi took to X with an “urgent request for everyone to take action tonight.”
The AI Factor: Discovery at Machine Speed
What distinguishes this incident from previous supply-chain crises is the role of artificial intelligence in the discovery process. Researchers at Calif and Wiz leveraged OpenAI’s latest code-analysis models to comb through PHP’s sprawling codebase, identifying logic errors that had evaded human review for years. “The underlying bugs weren’t new; what changed was our ability to find them,” said Salil Kanhere of UNSW Sydney.
OpenAI acknowledged the dual-use nature of the capability in a blog post, noting that while AI can harden defences, it equally “helps attackers rapidly develop offensive tools and exploits.” The company has released a scanning utility to help administrators verify their PHP deployments. The leak of technical details ahead of the coordinated disclosure forced the PHP Foundation’s hand, compressing the remediation window and amplifying the chaos. Matthew Prince, chief executive of Cloudflare, reported seeing thousands of exploit attempts in the ten hours before public announcement — a figure that surged to millions within two hours of disclosure.
The Long Tail: Embedded Systems and the Patching Gap
Daniel Stewart, head of threat intelligence at LRQA, sounded a note of caution that extends beyond web servers. “PHP is not limited to web applications,” he said. “It is commonly found in the management interfaces of network appliances, load balancers, and embedded devices, which are often overlooked during these incidents.” Early scanning data suggests patch adoption is climbing but remains uneven, particularly among smaller organisations lacking dedicated security operations. Ken Munro, a veteran ethical hacker, likened the remediation to “running a Windows update” — straightforward in principle, but easily neglected in practice. The UK’s National Cyber Security Centre has advised taking sites offline if rapid patching proves impossible, while the NSA urged “heightened awareness” and continuous monitoring of vendor advisories in the weeks ahead.
Single-sentence paragraph for emphasis: The window for quiet remediation has slammed shut.
Why it Matters
The php2shell episode is a watershed moment for software supply-chain security. It proves that AI-driven vulnerability discovery has moved from theory to operational reality, collapsing the timeline between flaw introduction and exposure. For the industry, the lesson is brutal: legacy codebases — especially those underpinning critical infrastructure — are no longer safe by obscurity. The patches exist, but the real test lies in the messy, human logistics of deployment across a fragmented global estate. How quickly the long tail of embedded devices, forgotten microsites, and under-resourced SMEs can be secured will determine whether this episode is remembered as a near-miss or a catastrophe.
