Governments across Europe and Canada pulled public websites offline on Wednesday, Oct. 21, 2026, after the PHP project released emergency patches around 9:30 a.m. ET for two critical flaws that can let an attacker take over a web server without a password. The bugs, nicknamed "php2shell," sit in the core of the programming language that runs most of the world's websites, and Amazon says they are already being exploited.
The PHP security team said fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 close both holes and told every user to update immediately, warning in its official security advisory that "there are no complete mitigations, updating is the only safe choice."
The flaws were found with artificial intelligence. Two security firms, Calif and Alphabet-owned Wiz, said they used large language models to uncover vulnerabilities that had been hidden in PHP's code for more than a decade, according to Reuters. The episode is one of the clearest real-world tests yet of how AI is changing the race between defenders and attackers.
Key Facts
- When: Patches released Oct. 21, 2026, around 9:30 a.m. ET (13:30 UTC), ahead of a planned 14:00 UTC release; an exploit attempt was first detected Oct. 17.
- Where: Global; government sites taken offline in the Netherlands, Denmark, France, Finland and Canada, among others.
- Who: The PHP security team; researchers at Calif and Wiz; Amazon Threat Intelligence; CERT-EU; the U.S. Cybersecurity and Infrastructure Security Agency (CISA).
- What: Two unauthenticated remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 on the CVSS v4.0 scale.
- Affected: PHP versions from 5.4 through 8.5.11; no official fixes for 8.1 and older.
- Scale: PHP powers roughly 70 to 75 percent of websites whose server language can be identified, per W3Techs figures cited by Reuters.
- Status: Developing; Amazon reports the flaws are "now being broadly exploited in the wild."
What Happened With the PHP Vulnerability
The disclosure did not go as planned. On the morning of Monday, Oct. 20, a post on Hacker News claimed two critical PHP bugs were about to go public, and screenshots spread on social media after the post was removed, security firm Huntress reported. Researchers at watchTowr confirmed the leak, writing that "we were all supposed to wait until Thursday at 11am ET."
Later that day, PHP posted an advance notice scheduling an emergency release for Wednesday at 14:00 UTC and reserving the right to move sooner "should evidence of active exploitation appear in the wild." That was a day earlier than the original embargo, Huntress said, and Tenable reported that the release was moved up after CVE identifiers leaked.
The two bugs are memory-handling errors deep inside PHP. In the first, running out of memory can interrupt PHP while request data is only partly set up, and cleanup code then treats that broken data as valid. In the second, data from one web request can survive after its memory is freed and be reused by the next request on the same worker, PHP said in its advisory.
Every common way of serving PHP is exposed, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed, with mod_php rated highest risk, Rapid7 said. Rapid7 urged organizations to patch "on an emergency basis, outside of normal patch cycles."
As patches landed, governments started pulling sites. In the Netherlands, the Port of Rotterdam, the government portal Overheid.nl, the national football federation KNVB, the websites of the five largest political parties and several hospitals went offline, Reuters reported. Danish municipal IT provider Kombit shut down sites, and the operator of Wikipedia took down an unspecified number of systems.
Canada's Minister of Artificial Intelligence and Digital Innovation, Evan Solomon, said on X that some federal sites were temporarily taken offline and urged site operators to update, Engadget reported. Japanese Prime Minister Sanae Takaichi told website owners to "check whether your live site uses PHP and prepare to apply the new fix," according to Reuters.
"All servers using any version of PHP released in the last 20 years will be vulnerable," said Tiffany Farriss, interim CEO of the Drupal Association.
Timeline
| Date/Time ET | Event |
|---|---|
| Aug. 1, 2026 | Calif says it found the flaws using a large language model |
| Aug. 11, 2026 | Calif, working with OpenAI, reports the first flaw to PHP |
| Aug. 24, 2026 | Wiz independently reports a second flaw |
| Fri., Oct. 16 | White House says it was made aware of the issue |
| Sat., Oct. 17 | Amazon's MadPot honeypot records an exploit attempt, four days before disclosure |
| Mon., Oct. 20, morning | Hacker News post leaks the coming disclosure |
| Mon., Oct. 20 | PHP posts advance notice; CERT-EU issues advisory 2026-018 |
| Wed., Oct. 21, ~9:30 a.m. | PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 |
| Wed., Oct. 21, by 4:40 p.m. | Calif and Wiz technical write-ups available, per Huntress |
| Wed., Oct. 21, evening | Amazon says the flaws are being broadly exploited |
Who's Involved
The PHP security team, the volunteer-driven group that maintains the language, coordinated the fix and gave Linux distributions and long-term support vendors the patches in advance, its advisory said.
Calif, a security firm, said it discovered the flaws with a large language model; researcher LCFR of Calif developed the exploit chain named php2shell, Tenable reported. Wiz, owned by Alphabet, said it found the bugs using its Wiz Atlas tool together with Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol models, Reuters reported. Wiz called the flaws among "the most severe vulnerabilities discovered in PHP, and arguably in software history," according to a Reuters explainer.
Amazon, through security chief CJ Moses, said the bugs were "now being broadly exploited in the wild," though it was unsure whether the attempts would have worked against real sites, per Reuters.
Google Cloud CISO Chris Betz and Google DeepMind's head of Gemini security, Raluca Ada Popa, wrote that Google Cloud itself is not vulnerable but that customers running PHP on it may be, in a Google Cloud blog post.
CISA issued an alert urging organizations to apply the patch, Engadget reported. The Trump administration said it was "tracking and coordinating with federal agencies and leading SI labs to expedite the release of the fix," according to Reuters.
The OSINT Picture
Internet-scanning data gives a sense of the exposure. Censys found that about 1.5 million of 2.6 million hosts it tracks run a PHP version with no fix available, Reuters reported. That figure reflects end-of-life versions that the PHP project will not patch, not every unpatched server.
Honeypot data is the strongest early warning. Amazon's MadPot sensors logged an exploitation attempt from an anonymous IP address on Oct. 17, four days before disclosure, Tenable and Reuters reported. It remains unclear how that attacker obtained the exploit details.
Other vendors report mixed signals. Others reported seeing attacks emerging, Huntress noted, while Huntress itself said it had not seen in-the-wild exploitation on its partners' systems as of 4:30 p.m. ET Wednesday. PHP's team reviewed proof-of-concept code posted after the leak and found no working exploits at release time, Tenable said. Ecker Geopolitics could not independently verify the number of successful compromises.
Geopolitical Players
The European Union moved fastest. CERT-EU told organizations that could not patch to take affected sites offline rather than leave them exposed, Reuters reported. The Dutch National Cyber Security Centre took its own website offline as a precaution.
Canada and Japan issued public warnings at the leadership level, a sign of how seriously allied governments viewed the risk.
No government has publicly attributed the early exploitation to a state actor. The risk for every country is the same: a single flaw in shared open-source code becomes a shared attack surface. Earlier this month, Ecker Geopolitics reported on hackers hijacking Danfoss refrigeration controllers in French supermarkets and on zero-click spyware delivered through online ads, both reminders that everyday infrastructure is now a target.
What It Means for the United States
Benefits and opportunities
- U.S.-based firms and AI models were central to finding and fixing the flaws before full disclosure, a demonstration of American AI leadership in defensive cybersecurity (analysis).
- Major U.S. cloud providers, including Google Cloud, say their own platforms are not vulnerable and have automatically patched some supported runtimes, such as App Engine standard.
- The coordinated disclosure gave Linux vendors patches in advance, limiting the window for attackers.
Risks and dangers
- PHP runs WordPress, Drupal, Joomla and Magento, which power many state, local and small-business sites in the United States; unpatched servers are open to takeover.
- Exploitation began before disclosure, and Costin Raiu of TLP:Black warned of a possible "mass compromise of every vulnerable web server on the internet," per Reuters.
- The same AI tools that found the bugs can help adversaries find the next ones faster. "The scale is huge, and with AI, exploitation may happen instantly," said Lukasz Olejnik of King's College London, according to Reuters.
- With the Nov. 3 midterm elections less than two weeks away, any compromise of PHP-based election or county websites could fuel confusion (analysis).
Want the deeper read? Pro Truth Seeker members get the daily Intel Briefing, members-only deep dives on cyber and AI threats, and the full archive. Become a member.
What's Next
PHP 8.2 reaches end of life on Dec. 31, 2026, and will get no security fixes after that date, PHP said. Operators on 8.1 or older must upgrade or rely on limited source backports for 7.4 through 8.1.
Rapid7 expects a working public exploit soon. Watch for CISA to decide whether to add the two CVEs to its Known Exploited Vulnerabilities catalog, which would set federal patch deadlines; as of Tenable's Oct. 21 analysis, they were not listed.
Stay ahead of the next cyber shock: subscribe to the Ecker Dispatch and cast your vote in today's poll.
Sources
- PHP: Security advisory: Critical remote code execution vulnerabilities, update now, Oct. 21, 2026
- PHP: Upcoming Critical PHP Security Release, Oct. 20, 2026
- Reuters via Global Banking & Finance Review: Cyber agency warns websites go dark as PHP prepares critical fixes, Oct. 21, 2026
- Reuters via Global Banking & Finance Review: Explainer: What are the PHP flaws taking government websites offline?, Oct. 21, 2026
- Engadget: Government websites in the EU and Canada taken offline over PHP vulnerability, Oct. 21, 2026
- Tenable: php2shell (CVE-2026-109618, CVE-2026-109619) FAQ, Oct. 21, 2026
- Huntress: Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities, Oct. 20, 2026 (updated Oct. 21)
- Rapid7: CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP, Oct. 21, 2026
- Google Cloud: Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, Oct. 21, 2026