PHP2Shell: AI Found a Critical PHP Flaw, Sites Go Offline
Two critical vulnerabilities in PHP — the programming language quietly powering roughly 70 percent of the world’s websites — were publicly disclosed on Wednesday, October 21, 2026, and the fallout was immediate. Dubbed “PHP2Shell”, the flaws let attackers run their own code on affected servers and read sensitive data like passwords from server memory. Within…
Two critical vulnerabilities in PHP — the programming language quietly powering roughly 70 percent of the world’s websites — were publicly disclosed on Wednesday, October 21, 2026, and the fallout was immediate. Dubbed “PHP2Shell”, the flaws let attackers run their own code on affected servers and read sensitive data like passwords from server memory. Within hours, government websites in Finland, the Netherlands, France, Germany and Belgium were taken offline as a precaution, the PHP Foundation rushed out an emergency fix, and Cloudflare’s CEO reported exploit attempts exploding from thousands to millions. If you run a website — especially a WordPress site, which runs on PHP — this is the one story this week you cannot afford to skim.
What makes PHP2Shell different from the usual patch routine is how it was found: not by human researchers, but by artificial intelligence. The flaws had been hiding in PHP’s code for more than a decade — until frontier AI models finally dug them out.
PHP2Shell at a glance — everything confirmed so far
| Detail | Confirmed information |
|---|---|
| The flaw | PHP2Shell — two critical vulnerabilities in the PHP programming language (CVE-2026-109618 and CVE-2026-109619, as reported by Times Now) |
| How it was found | AI-assisted security research by teams at OpenAI, Google-owned Wiz, and security firm Calif — using OpenAI’s GPT-5.6 Sol model, Google’s Gemini 4 Argon, and Wiz’s Atlas security agent |
| Hiding in plain sight | The flaws sat in PHP’s code for more than 10 years — Wiz describes it as “decades” |
| Disclosed | Wednesday, October 21, 2026, after details leaked online |
| Fixed | The PHP Foundation released the patch on October 21, 2026 |
| What attackers can do | Run their own code on vulnerable servers (remote code execution) and read server memory — including passwords. The US National Security Agency describes “a direct path to the server’s file system or database” |
| Who is affected | Any site running an unpatched, vulnerable PHP version — PHP powers about 70% of websites worldwide (Wiz estimate), including WordPress sites |
Discovered by AI — not by humans
The flaws were first found back in August 2026, when teams at OpenAI, Wiz and Calif turned AI systems loose on PHP’s source code. OpenAI — the company behind ChatGPT, which recently began testing ads in 26 countries including Pakistan — deployed its GPT-5.6 Sol model, while Google’s side used Gemini 4 Argon alongside the Wiz Atlas security agent.
The exploit chain the AI uncovered was extraordinarily complex — Wiz says it sat “at the edge of what human researchers could practically achieve.” And it was fast: “with frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work.” Vulnerabilities once considered practically undiscoverable are now findable by anyone with a powerful enough model.
Why governments pulled their websites offline
When a flaw lets attackers read server memory and reach into a server’s file system, governments do not wait. As a precaution, government websites in Finland, the Netherlands, France, Germany and Belgium went dark until their systems could be patched. The UK is checking for traces of exploitation, and the US National Security Agency urged organisations to patch immediately or pull their systems offline. The UK’s National Cyber Security Centre added: “Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.”
Cloudflare CEO Matthew Prince posted on X that exploit attempts went from thousands in the 10 hours before the announcement, to tens of thousands in the 45 minutes after it, to hundreds of thousands within 2 hours — and millions now. Attackers move the moment a disclosure goes public. But AWS says the flaw is “not being broadly exploited in the wild” so far — mass scanning is not the same as mass break-ins, but with an attack surface this large, nobody is treating the distinction as comfort.
“Among the most severe … arguably in software history”
Security people are not known for understatement — which makes Wiz’s verdict striking: PHP2Shell is “among the most severe vulnerabilities discovered in PHP, arguably in software history” — openly compared to Heartbleed, the 2014 flaw that forced a global password-changing panic. Volker Dusch, a security engineer at the PHP Foundation, told the Wall Street Journal it is the most severe PHP issue in more than a decade.
Alp Toker, director of the internet-monitoring organisation NetBlocks, called it “highly impactful”: “anybody on the web can essentially access your web server if you’re running the [PHP] software.” His warning about what comes next is the part that should keep everyone up at night — with agentic AI in the picture, “these systems are going to continue to get compromised — month after month, year after year.”
What PHP2Shell means for Pakistan’s websites
The News Pakistan gave this story prominent coverage, and for good reason: the blast radius includes Pakistan. WordPress runs on PHP — and WordPress powers millions of Pakistani business websites, news portals, blogs and online stores. This very website, timelyups.com, runs on WordPress. So do countless small-business sites across Lahore, Karachi and Islamabad.
If you are a typical Pakistani site owner on shared hosting, you do not manage PHP yourself — your host does, and reputable hosts began patching within hours of the October 21 disclosure. Your job is to confirm: open a support ticket and ask one direct question — has our server’s PHP been updated to the patched version released October 21? If you run your own VPS or dedicated server, the responsibility is yours and the window is today, not next week: update PHP to the patched release, then update WordPress core, plugins and theme — and take a full backup before you touch anything.
What to do right now — a practical checklist
- Confirm your patch status. Shared hosting: ask your host (ticket or live chat). VPS/dedicated: apply the October 21 patched release immediately.
- Update WordPress core, plugins and themes. Attackers chain server flaws with outdated plugins. Updates are free; incident response is not.
- Verify your backups. A backup you have never tested is a hope, not a plan — check one recent full backup.
- Do not take your own site offline in a panic. The NSA/NCSC offline guidance was aimed at organisations that cannot patch immediately. For a normal updated site, staying patched beats going dark.
- Follow the official advisory, not forwarded messages. WhatsApp forwards are already mixing this up with old hoaxes — stick to the PHP Foundation’s security announcements.
It has been a brutal week for tech news — alongside this security earthquake, we have also covered WhatsApp’s new iOS in-app browser opening links in chats and EA’s shock shutdown of BioWare. But PHP2Shell is in a different league: the rare story where AI did not just write the headline — it found the flaw itself. Patch now, confirm with your host, and keep an eye on TimelyUps for updates as this story develops.
By Fatima Raza — Technology Desk, TimelyUps. Updated: October 22, 2026.
