On Wednesday 21 October 2026, a large slice of the public internet simply switched itself off. Finnish government services went dark. Dutch parliamentary websites, the country’s cybersecurity authority and its data protection regulator did the same. In Canada, broadcasters reported that the Canadian Centre for Cyber Security’s own site was unreachable, and Montreal’s transit agency, the STM, confirmed it had pulled its website down as a precaution while the problem was sorted out.

None of these organisations had been hacked. They were getting out of the way of something worse — and the thing they were running from had been found, in large part, by artificial intelligence.

What actually broke

The PHP Foundation published an emergency security release covering two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell by the researchers who reported them. Both are rated CVSS 9.2 — critical — and both allow unauthenticated remote code execution. In plain terms: an attacker who can send a request to a vulnerable site may be able to run their own code on the server, with no password and no user account required.

The bugs are not in anyone’s application code. They sit in PHP’s core engine, in the way it handles fatal errors — particularly out-of-memory conditions. When PHP bails out of a request, it has historically left memory in an inconsistent state: use-after-free conditions in the upload-progress unserializer and in fatal-error backtrace handling, plus an OPcache type confusion. Alongside the code execution path there is a second, quieter problem remote process-memory disclosure, which can leak passwords, session tokens, API keys and certificates straight out of the server’s memory to anyone who asks the right way.

Because the flaw lives in the interpreter itself, a perfectly well-written, fully-patched application can still be vulnerable. Researchers at Wiz demonstrated unauthenticated code execution against current container images of WordPress, Drupal and Joomla without touching a line of application code.

Scale

Wiz estimated the issue touches around 70% of the internet — a number it has not fully shown the working for, but which is plausible given PHP’s footprint. WordPress alone runs roughly 40% of all websites.
Palo Alto Networks’ Cortex Xpanse telemetry identified more than 22.6 million exposed instances that were potentially vulnerable.
Affected code paths reach back as far as PHP 5.4. Every PHP release of the last decade carries at least one of the bugs. One limited variant was spotted in 2024 and not judged significant at the time. The underlying defect is roughly fourteen years old.

The AI part — which is the real story

This is where PHP2Shell stops being an ordinary disclosure and starts being a landmark.

The first thread was pulled on 1 August 2026 by Calif, a California AI red-teaming outfit, using OpenAI’s GPT-5.6 Sol. Calif had been invited into OpenAI’s Patch the Planet initiative — an effort to point frontier models at the open-source software everything else is built on. Calif reported what it found to OpenAI, which investigated further and turned up additional components of the flaw.

Independently, on 19 August, Wiz Research — Sagi Tzadik, Shir Tamari, Nir Ohfeld and Tomer Schwartz — found the first issue using a combination of Google’s Gemini 4 Argon, GPT-5.6 Sol and the company’s own Wiz Atlas. In its write-up, Wiz credits Gemini 4 Argon with a substantial role across the whole lifecycle: finding the bug, building a working exploit, writing detections, and then validating that the eventual patch actually closed the hole.

Two separate teams, using two different frontier models, independently surfaced a fourteen-year-old memory-safety defect in one of the most heavily reviewed codebases on the planet, within three weeks of each other. Wiz described the moment as an AI inflection point. That reads less like marketing than it might have a year ago.

OpenAI then did the unglamorous part: it convened a coalition — the PHP Foundation, Wiz, Calif, Cloudflare, Quarkslab and US government agencies — to coordinate a patch, pre-position mitigations and manage disclosure. Nearly three months passed between first discovery and public release.

The uncomfortable symmetry

Every participant made the same point, in different words. The capability that found this bug is the capability that will find the next one — for whoever is holding it. OpenAI noted plainly that the same abilities that surface internet-scale flaws can also help attackers rapidly build offensive tooling. When exploit development stops being a specialist craft and becomes something a model can iterate on overnight, the window between “patch released” and “patch required” compresses toward zero.

That is not hypothetical here. Proof-of-concept exploits were circulating within hours of disclosure. Cloudflare reported early attack traffic almost immediately. watchTowr observed in-the-wild exploitation attempts using proof-of-concept code identifiable by a php2shell User-Agent string, and said at the time that none had succeeded. Unit 42 confirmed it had seen working proof-of-concept code.

The defenders got a roughly twelve-week head start, because humans chose to coordinate rather than publish. That head start was a policy decision, not a technical guarantee — and it is the only reason this week looks like an inconvenience rather than a catastrophe.

What to do if you run a PHP site

1. Patch. This is the only complete fix. The fixed releases are:

Branch	Patched version
PHP 8.5	8.5.12
PHP 8.4	8.4.27
PHP 8.3	8.3.36
PHP 8.2	8.2.35

2. Understand that every way of serving PHP is in scope. mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed are all affected. The PHP developers consider mod_php the highest risk, because a demonstrated exploit can execute before any application code runs at all.

3. Do not assume your CMS auto-updater has you covered. Wordfence warned explicitly that WordPress automatic updates do not apply this fix — it is a PHP-level patch, not a plugin or core update. If someone else hosts your site, contact them and get written confirmation of the PHP version now running.

4. If you cannot patch immediately, take the site off the public internet. This is exactly what the Dutch and Finnish authorities did, and what CERT-EU advised: isolate internet-facing applications from public networks until a fix lands. An hour of downtime beats a breach notification.

5. Use the stopgaps while you wait. Cloudflare, Fastly and Vercel published out-of-the-box protections, and Cloudflare deployed firewall rules as a temporary measure.

6. Check your logs for the fingerprints. Wiz flagged the signals worth hunting for: unusual multipart requests followed by memory-limit errors, repeated HTTP 500 responses, unusually large or malformed PHPSESSID cookies, and unexplained PHP worker churn.

7. Assume secrets may have leaked. Given the memory-disclosure component, if your site was internet-facing and unpatched, rotate API keys, tokens and credentials rather than hoping.

Also read: Why Downloading Apps From Random Websites Is Riskier Than You Think

The bigger takeaway

PHP2Shell will be remembered for the websites that went dark, but that is the least interesting thing about it. The interesting thing is that three independent AI-assisted research efforts converged on a defect that fourteen years of human code review, fuzzing and bug bounties had walked past.

Wiz also noted that other, unreported variants of this bug class probably exist, and that the patch targets the root cause for exactly that reason. Translated: the models are not finished with PHP, and PHP is not the only decades-old C codebase holding the internet up.

The open question is no longer whether AI can find serious vulnerabilities in critical infrastructure. It demonstrably can. The question is whether the coordinated, three-month, grown-up disclosure process that defused this one can keep pace when the other side has the same tools and none of the patience.