Critical PHP Flaw: Global Shutdowns & Emergency Patches

A critical vulnerability in PHP, the programming language powering nearly 70% of websites, has triggered worldwide government shutdowns and emergency patching after security researchers confirmed the flaws had lurked undetected for over a decade. Dubbed PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, the bugs allow unauthenticated remote code execution, meaning attackers can seize control of web servers without prior access or authentication.

What is PHP2Shell?

PHP2Shell is the collective nickname for two critical vulnerabilities in the PHP engine itself, not in hosted applications or configurations. Because PHP runs on most major operating systems and is embedded in HTML to build dynamic web pages, servers running affected versions are exploitable regardless of the website code they host. The PHP Foundation issued patched releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026 after details leaked on social media, according to the BBC. The flaws affect roughly 70% of websites, though that estimate remains unverified. This incident underscores how a single weakness in open-source web infrastructure can ripple across public and private systems worldwide.

Global Government Shutdowns

Within hours of disclosure, several European governments and agencies took services offline as a precaution. The Guardian reported that Belgian, Dutch, Finnish, French and German government sites were temporarily taken down, along with Australian systems and the Dutch national digital identity service. Finland shut down public government web services, while the Netherlands took its health agency and parliament sites offline. UK council sites and 32 government services were also briefly unavailable, and Edinburgh Council's website went down. Wikimedia took several systems offline as a precaution, briefly affecting parts of Wikipedia.

These precautionary takedowns reflect how government cybersecurity agencies now prioritise isolation over availability when critical flaws emerge. The table below summarises key responses.

Emergency Patching and Official Warnings

The US National Security Agency issued an advisory urging critical patching of PHP2Shell and warning that attackers could steal data, disrupt services, or move deeper into networks. The NSA said organisations unable to patch immediately should take systems offline. The UK's National Cyber Security Centre sent 50,000 alerts and advised checking for attacker-installed backdoors, calling the scale unprecedented. CERT-EU warned of possible unauthenticated remote code execution, and early attacks began emerging within hours.

Both flaws scored 9.2 out of 10 on the CVSS severity scale. Security agencies recommend maintaining heightened awareness of internet-facing devices, inventorying vulnerable PHP versions, prioritising vendor patches, and replacing end-of-life PHP services. Following these steps is now part of standard PHP patching procedures for critical infrastructure.

The AI Discovery and Race to Exploit

Researchers from Wiz and Calif discovered the vulnerabilities using OpenAI's Patch the Planet AI tools after a memory-management flaw was first suspected in 2024 and confirmed in August 2026 using AI models including GPT-5.6 Sol and Gemini 4 Argon. The bugs had gone undetected for more than ten years. Cloudflare logged thousands of exploit attempts ten hours before disclosure; within 45 minutes of the announcement attempts reached tens of thousands, then hundreds of thousands after two hours, and millions by 22 October. Amazon Threat Intelligence said the flaw was being broadly exploited in the wild.

The rapid escalation shows how AI vulnerability discovery can compress the window between disclosure and exploitation, forcing defenders to react within minutes rather than days.

FAQ

What is the critical PHP flaw?

It is a pair of unauthenticated remote code execution vulnerabilities nicknamed PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, affecting nearly 70% of websites.

Which countries took government websites offline?

Belgium, the Netherlands, Finland, France, Germany, Australia and the UK took services offline or issued emergency guidance, according to the Guardian and BBC.

How do I fix the PHP vulnerability?

Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 immediately. If patching is not possible, take affected systems offline and monitor for backdoors.

Why is PHP2Shell so dangerous?

It allows attackers to execute code on a server without authentication, potentially leading to data theft, service disruption and deeper network intrusion.

Was AI used to find the flaw?

Yes, Wiz and Calif researchers used OpenAI's Patch the Planet AI tools, and the flaw was described as the most significant ever found by AI.

Conclusion and Future Outlook

The PHP2Shell episode demonstrates that a single vulnerability in widely used open-source software can disrupt public services across continents and trigger emergency patching at national scale. Security analysts fear a long tail of unmaintained, permanently vulnerable sites. Moving forward, improving web server security and reducing reliance on unsupported PHP versions will be essential to prevent similar mass-compromise events.