Within hours, major organizations in Europe, Asia, and Australia found themselves facing a difficult choice: keep their websites vulnerable, or take them out of service temporarily. The reason is two critical security vulnerabilities in PHP, the programming language on which about 70% of websites around the world depend.
But what makes the incident more disturbing is not the extent of the spread of the language alone, but rather the role played by artificial intelligence: it helped discover the two vulnerabilities, while the tools themselves are now able to accelerate their exploitation. While the PHP team rushed to issue urgent updates, security agencies in Washington, London and Berlin issued warnings of possible attacks, according to Reuters and ABC News.
The incident raises questions about the ability of organizations to fix vulnerabilities as quickly as artificial intelligence tools allow them to be discovered and exploited.
What happened?
Exactly two days ago, the PHP team announced an emergency release without providing any details, saying it would be released on October 21 at 14:00 UTC. The team stated that “the updates fix two critical vulnerabilities that allow remote command execution without authentication,” and called on all users to adopt the update immediately.
Prior to the launch of this release, the response teams concerned with the European Union institutions, bodies and agencies, CERT-EU and CERT.at, warned of the existence of a security vulnerability, but without revealing its details, and later the German Office for Information Security (BSI) warned of the same matter. The Dutch Cyber Security Center (NCSC-NL) reported that a public exploitation model (Proof-of-Concept) had appeared shortly before the update was released, according to the Security Insider website.
It should be noted that PHP is a programming language that runs on servers to run websites and process their requests. It is widely used in content management systems such as WordPress, and many websites and e-stores rely on it. Therefore, it has been considered for years one of the most important Internet technologies.
Who are affected?
For the majority of users, the current cyber crisis has so far manifested itself in the form of daily disruptions: sometimes the city's appointment booking portal becomes unavailable, sometimes the online customer section stops working, or a message appears indicating maintenance work, according to what the German newspaper Bild reported.
Users feel the effects of this security breach, especially if they are accustomed to using digital services regularly. Anyone who tries to book a medical appointment, download government documents, log into his account with a company, or purchase tickets online may currently face difficulties after operators stopped their websites in order to secure their systems.
As for ordinary users, there is no need to panic. The vulnerabilities originally affect the servers of website operators, and not the devices or phones of their visitors. So far there are no concerns about the data of ordinary users. The responsibility for correction is now mainly borne by the owners of blogs and websites that are run on systems such as WordPress or any other system based on PHP.
According to experts, the greatest danger to users does not lie in the vulnerability itself, but in the fraud attempts that may follow it. Fraudsters take advantage of current news to send emails or SMS messages with subject lines such as “Change your password” or “Please confirm your details again.”
What do we know about the two vulnerabilities technically?
The two vulnerabilities are coded CVE-2026-109618 and CVE-2026-109619, and are known in the media as “PHP2Shell.” Both have a severity score of 9.2 out of 10 according to the CVSS 4.0 scale, an open, standardized global standard used to evaluate the severity of vulnerabilities in software and information systems.
The defect is not in a specific site, nor in an add-on or template, but rather in the PHP engine itself, that is, the program that runs on the server and prepares the site pages for each visitor. In both vulnerabilities, the attacker can manipulate the way the engine handles memory, leaving behind chaos in its memory, and then exploit this chaos to run his own commands.
Both vulnerabilities lie in the PHP engine itself, and are related to a flaw in memory management that allows an attacker to tamper with the way requests are processed, and then execute commands on the server with site privileges, without a password or user interaction. In both cases, the attacker can run commands on the server with the same privileges as the site, without the need for a password and without any user clicking on a link, according to the Security Insider magazine website.
The amount of exposure
The numbers vary between sources, but they range around 70% of websites around the world, and they also include the WordPress interface used in more than 40% of websites around the world. Reuters quotes W3Techs, the global platform specialized in tracking and analyzing Internet technologies, that PHP works in about 75% of websites whose language can be determined.
According to Unit 42 of the American company Palo Alto, which specializes in cybersecurity, there are about 22.6 million versions of PHP exposed on the Internet. Data from Censys (a research platform and cybersecurity tool used to research and analyze devices and systems connected to the Internet) adds that about 1.5 million out of 2.6 million hosts running a version of PHP do not have a fix available.
Tiffany Farris, interim CEO of the Drupal Open Source Content Management Association, said that all servers using a version released within the past 20 years are at risk, according to what Reuters and Security Insider reported.
Wave of closures
Following the discovery of the two vulnerabilities, government institutions and public bodies rushed to suspend websites and electronic services as a precaution. In the Netherlands, the National Cybersecurity Center closed its website, and other institutions followed suit, including the Port of Rotterdam, the Dutch Football Association, the websites of the five major parties, and the websites of several hospitals. The closures also affected the national digital identity service and the House of Representatives website.
In France, the Ministry of the Interior placed all its websites in “preventive maintenance,” and local government websites, including the Paris Police Department website, were out of service. In Britain, the websites of the Edinburgh, Bristol, and Oxford councils were closed.
The Dutch Prime Minister commented that he is closely monitoring the situation. Japanese Prime Minister Sanae Takaichi called on website owners to verify their use of PHP and prepare to implement the fix, according to Reuters. The White House said it learned of the vulnerability on Friday, October 16, 2026.
Who discovered the vulnerability?
Accounts vary regarding the discovery of the two vulnerabilities, with OpenAI, an artificial intelligence specialist, saying that it led a collaboration to prepare fixes before announcing them, and described the flaw as “one of the most impactful vulnerabilities in recent memory” and that it represents a “new phase” in which artificial intelligence can find vulnerabilities with Internet-wide impact.
Security company Calif, in turn, said that it discovered the vulnerabilities with the help of a large linguistic model on August 1. Wiz, which specializes in cloud cybersecurity and is owned by the technology giant Alphabet, said that it found the vulnerabilities independently through its Wiz Atlas tool using the Gemini 4 Argon model from Google and the GPT-5.6 Sol model from OpenAI. She added that the vulnerabilities remained undiscovered for more than a decade, and that exploiting them was very complicated for a human hacker, and that artificial intelligence removed this barrier.
Technology portal CNET attributes the discovery to Calif using the GPT-5.6 Sol artificial intelligence model, citing the OpenAI blog, while confirming that Wiz came up with it independently. Calif and Wiz said they coordinated with each other and the PHP and OpenAI team.
Have the two vulnerabilities actually been exploited?
Amazon Threat Intelligence (an integrated, continuous defense and research system for collecting, analyzing, and processing data related to cyberattacks and vulnerabilities) said that it detected an attempt to exploit one of its phishing systems (Honeypot) on October 17, that is, four days before the vulnerability was announced. CJ Moses, its security official, stated that the source of the attempt was an unknown Internet address, and that it was not clear how the attacker knew of the vulnerability during the ban period.
Amazon monitored other attempts on the day of the announcement, some hours before the fix. The diversity of methods indicates the presence of multiple attackers. It said that exploitation samples appeared within hours of the fix being released, and that “PHP2Shell” is now being widely exploited, according to The Guardian.
Jake Knott, head of threat intelligence at watchTowr, a platform specializing in cybersecurity, said that his company is monitoring attempts to actually exploit the vulnerabilities, but “no one has succeeded so far,” and he does not expect that to last long, according to what CNET reported.
Professor Alan Woodward (University of Surrey) in the United Kingdom warned of a crisis that may last a long time due to a huge list of unmaintained sites that may remain vulnerable to attacks for weeks and months. Michal Wojniak, an expert in Internet infrastructure, told The Guardian that automated exploitation of the vulnerabilities will be widespread, and may include cryptocurrency mining and denial-of-service attacks.
What to do?
Experts advise installing security updates immediately, rebooting affected systems, and checking previous indicators of compromise to install the fix; An update alone does not address a breach that has already occurred.
The bottom line is that the average user does not face a direct danger from the two vulnerabilities, but he may suffer from service interruptions, and the greatest danger to him comes from fraud attempts, not from the vulnerability itself.
