Skip to content
NX
App

The Bug That Hid for 12 Years Until AI Found It in a Week — and Governments Took Their Own Websites Offline to Survive It

Technology News x/technology ·
The Bug That Hid for 12 Years Until AI Found It in a Week — and Governments Took Their Own Websites Offline to Survive It

The Bug That Hid for 12 Years Until AI Found It in a Week — and Governments Took Their Own Websites Offline to Survive It

Published: October 22, 2026 | Reading Time: ~10 minutes | Channel: technology

Seventy percent of the web runs on one programming language, and on October 21 the agencies that defend it — the US National Security Agency, CISA, Europe's ENISA — told the world to patch it immediately or take it offline.¹ Governments in three time zones pulled their own websites dark rather than leave a decade-old flaw exposed for one more news cycle. Nearly three dozen UK government services went unavailable, Japan's prime minister publicly told companies to consider suspending services, and Wikipedia's operator started precautionary takedowns.² The reason this happened now, after the underlying bugs sat undetected for more than a decade, is the single most important line in the disclosure: with frontier AI models, **a single researcher completed in a week what previously would have taken a world-class team months of work.**³ That sentence should be stapled to every CISO's monitor — and to every founder's business plan.

This is the PHP2Shell story. It is not a story about PHP. It is a story about what happens when the effort that used to protect your business stops being a security control.

The 72 Hours That Took Down Wikipedia, ANA, and Half of Europe's Government Sites

Start with what actually happened, because the timeline alone tells you how seriously the security world took this.

The flaws were found in late August by teams at OpenAI, Google-owned cybersecurity firm Wiz, and a research company called Calif. Under the rules of coordinated disclosure, everyone stayed quiet while PHP — the open-source language behind WordPress, Drupal, Joomla, and Wikipedia's MediaWiki — could build a fix. Then, on October 20, the vulnerability identifiers leaked onto Hacker News and social media, with an incorrect severity score of 10.0 attached.⁴ The PHP Foundation did the only responsible thing: it pulled the release forward a day and shipped emergency patches at 14:00 UTC on October 21, publicizing two CVEs — CVE-2026-109618 and CVE-2026-109619 — rated CVSS v4.0 9.2 each.⁴

The fallout was immediate and visible:

Security operations center with global exposure map

  • United Kingdom: Nearly three dozen government services unavailable and four partially unavailable while security work ran, per minister Elizabeth Lloyd's statement to the House of Lords — though no large public-facing critical services were affected, a spokesperson said.²
  • Japan: Prime Minister Sanae Takaichi posted on X that companies should check for PHP and prepare to apply the patch "as soon as possible," adding that firms should consider suspending services if necessary. All Nippon Airways, railway operator JR West, and Japan's largest bank, MUFG, all reported temporary webpage or service suspensions.²
  • Europe: Government websites in France, Denmark, Finland and the Netherlands — including the Dutch cyber security agency itself — went temporarily offline for fixes. Dutch PM Rob Jetten said his cabinet was "closely monitoring the situation."²
  • The open web: The Wikimedia Foundation confirmed a number of its systems were taken down as a "precautionary measure." Ireland's second most-used news site, The Journal, went dark Thursday morning to bolster its defenses.²

When the Dutch cybersecurity agency takes its own website offline, that's not panic. That's professionals treating a 9.2 the way a 9.2 deserves.

CISA's alert was blunt in the way government alerts rarely are: patch immediately to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, prioritize internet-facing systems — and if you can't patch, take the system offline until you can.¹ For anyone still running PHP 8.1 or earlier unsupported versions, CISA didn't offer a timeline. It offered an ultimatum.

By the Numbers: Why a 9.2 on PHP Is a 9.2 on Your Business

The raw figures behind this event, all verified against primary sources:

Metric Figure Source
Share of all websites running PHP ~70% CNN² / W3Techs 69.3% of known-language sites⁴
CVEs disclosed 2 (CVE-2026-109618, CVE-2026-109619) CISA¹
Severity (vendor, CVSS v4.0) 9.2 each PHP security team via Tenable⁴
Age of affected code Back to PHP 5.4 (every release of the last decade) Wiz³ / Calif⁴
Time bugs hid in the codebase More than a decade Wiz³, CNN²
Fixed versions 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 CISA¹, Tenable⁴
End-of-life branches No official fix for 5.4–7.3; minimal source backports for 7.4–8.1 Tenable⁴
Demonstrated impact Unauthenticated RCE on WordPress, Drupal, Joomla; app-agnostic memory disclosure Wiz³
First observed exploitation attempt October 17 — four days BEFORE public disclosure Amazon Threat Intelligence via Tenable⁴
Internet-exposed hosts (estimates) >1.3 million (Silas Cutler); >1.9 million Shodan count (Henk Poley) Tenable⁴ — researcher estimates, not official counts

Two rows in that table deserve a slow read.

First, unauthenticated remote code execution. Not "an attacker needs a user to click something." Not "an attacker needs a foothold in your network." The demonstrated exploit chains ran against stock, latest-version deployments of WordPress, Drupal and Joomla — and the vulnerabilities live in PHP's core engine, not in any application's code. Wiz's researchers noted that even a "Hello World" app on an affected PHP version can be vulnerable.³ Your application code being clean is irrelevant here. The floor itself was rotten.

Second, the memory disclosure primitive. Beyond full server takeover, attackers could read process memory without ever executing code — and that memory can hold passwords, authentication tokens, API keys and certificates belonging to other requests.³ In plain English: one vulnerable host can leak the session credentials of every visitor passing through it. If you run a store, a booking platform, or a subscription service, the thing being disclosed is your customer's checkout.

deVere Group CEO Nigel Green put the commercial exposure plainly: with PHP behind such a vast share of the web, "booking platforms, marketplaces, subscription services, ticketing sites, delivery apps and utility portals could all be holding card details on systems built with the same kind of code."²

And the exploitation clock started before the world knew the vulnerabilities had names. Amazon Threat Intelligence observed an exploitation attempt against its MadPot honeypot network on October 17 — four days before disclosure — with more attempts on October 21 carrying payloads and infrastructure suggesting multiple actors. Amazon's guidance cuts against every instinct a busy IT team has: **start your investigation from October 17, not from the disclosure date.**⁴ By October 21, Cloudflare's CTO Dane Knecht confirmed "early attacks emerging," with WAF rules deployed as a stopgap for all customers including the free tier — while stressing the rules only cover traffic routed through Cloudflare.⁴

There is one honest disagreement in the record, and it belongs in print: CISA stated it had not observed exploitation "as of the time of publication,"¹ while Amazon's threat intelligence said PHP2Shell is "now being broadly exploited in the wild."⁴ Both can be true — they're different sensors watching different windows — but prudence prices the pessimistic one.

Why "The Good Guys Found It First" Is the Wrong Takeaway

The mainstream framing writes itself: AI saved the internet! OpenAI and Google's Wiz found a decade-old bug and everyone patched in time. There's truth in it — the discovery was genuinely defender-led, the coordination was world-class, and Automattic, Akamai, AWS, Cloudflare, Fastly, Google, Imperva, Microsoft and Vercel all shipped guidance and mitigations before details went public.³ Credit where due.

But it's the wrong takeaway, and the people who found the bug are the ones telling you so.

Wiz's own post says the quiet part: the underlying flaws had been present for decades, and turning them into working exploits required "an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve."³ Read that again. For twelve years, the thing standing between a 9.2 remote-code-execution flaw and the 70% of the web that ran on it was tedium. Complexity. The sheer grinding effort of adapting an exploit across PHP versions, server configurations and memory layouts — work so specialist that effectively nobody bothered. That effort was the moat. Nobody ever patched it, because nobody knew it needed patching — it was simply too hard to matter.

Frontier AI collapsed the moat. As Wiz put it: "Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit," and with testing tools in the loop, models adapted working exploits across multiple applications in hours where a world-class human team would have needed months.³ Raluca Ada Popa, Head of Gemini Security at Google DeepMind, credited Gemini 4 Argon with an "invaluable contribution" to finding the vulnerability, developing the exploit, detecting attacks, and validating the patch.³

So let's update the doctrine, because the old one is now unsafe:

The security industry has quietly treated complexity as a patch. AI just removed the patch. Any asset you protect by assuming "attacking it is too complicated to be worth it" is — as of this disclosure — unprotected. Wiz says it directly: as the time and expertise required decrease, "complexity may no longer provide a meaningful barrier, changing how we define what is vulnerable in practice."³

Note the asymmetry, too. The same AI that found this bug and validated the fix in the hands of OpenAI, Wiz and Calif is available, in some form, to everyone. The defender won this round because the discovery happened to be made by the good guys with a responsible-disclosure culture. That is a fortunate outcome, not a structural guarantee. The next decade-old "theoretically unexploitable" flaw in your stack — in an SSO library, an image processor, an IoT firmware blob, an aging VPN concentrator — will not necessarily be found first by people who write blog posts. Amazon's honeypot already saw strangers probing PHP2Shell before the CVEs had public names.⁴

And here's the part that should genuinely worry anyone running a business: Tenable notes this exact class of failure isn't speculative. The CISA Known Exploited Vulnerabilities catalog already lists three vulnerabilities in PHP itself, two of them used in ransomware campaigns.⁴ PHP2Shell isn't the first time the internet's most-deployed language has been the door. It's just the first time the lock was picked with software instead of patience.

What This Means For You: The 72-Hour Checklist

Skip the theory. If you own, build, or fund anything with a web presence, here is what to do this week — concrete, in order:

  1. Inventory your PHP footprint today, not this week. CISA's first action item is identifying every system running PHP, and the agency warns PHP is often bundled inside other software where you can't directly see it.¹ That WordPress marketing site, that Magento store, that vendor portal your procurement team forgot about, that plugin-patched fork someone runs in a corner of AWS — all of it. If you don't have an asset inventory that answers "where does PHP run in my company?" in under an hour, that gap is the finding.

  2. Patch to the fixed versions: 8.5.12, 8.4.27, 8.3.36, or 8.2.35 — internet-facing systems first.¹ This is the only complete fix; the PHP security team says so explicitly.⁴ If you're on managed hosting (WordPress.com, WP Engine, Kinsta, whatever flavor), don't assume — open a ticket today and get the version in writing.

  3. Run the CISA ultimatum, not the CISA suggestion: unpatchable means offline. If a system runs PHP 8.1 or earlier and can't be updated immediately, CISA's guidance is to take it offline until it can be patched.¹ Yes, that's revenue disruption. So is a server takeover. The folks taking national rail and banking sites dark did this math already, and they chose downtime.

  4. If you cannot patch today, layer the partial mitigations and log the tells — while understanding they are not safety. PHP's advisory lists configuration changes that reduce specific attack paths: enforcing memory_limit=-1 in a way applications can't override (against CVE-2026-109618), and setting session.upload_progress.enabled=0 plus, on PHP 8.5, fatal_error_backtraces=0 (against CVE-2026-109619), with every PHP worker restarted after.⁴ Wiz adds the hunting signals: unusual multipart requests followed by memory-limit errors or repeated HTTP 500s, unexpectedly large or malformed PHPSESSID cookies, unexplained PHP worker churn.³ Cloudflare's WAF rules cover known vectors — for traffic through Cloudflare only — and Cloudflare itself calls it a stopgap.⁴ Partial protection is a bridge, not a destination.

  5. Re-scope your incident hunt back to October 17. Amazon Threat Intelligence's guidance is explicit: start investigations from at least October 17, not the disclosure date.⁴ Pull logs from that date forward. Look for the tells above. Check whether your keys, tokens and session stores show access you can't explain. If your threat model includes compliance or cyber-insurance, document this hunt — "we began investigating within 48 hours of disclosure" is a materially different sentence in an incident report than "we began when we read about it."

  6. Reprice every "too complex to exploit" assumption in your risk register. This is the durable lesson. Walk your register and flag anything whose residual risk rests on exploit difficulty: legacy internal tools, ancient API integrations, that firmware nobody touches. Wiz's thesis — complexity is no longer a meaningful barrier³ — means those line items just got repriced upward. If your security budget was justified by "nobody bothers attacking that," your justification expired on October 21.

IT team running an emergency patch at dusk

⚠️ The Risks Nobody's Talking About

  1. The variant problem is unresolved. Wiz disclosed four exploitable bug instances grouped under two CVEs — and explicitly says there are "other tracked, and likely untracked, variants" of the same memory-safety pattern in the PHP codebase.³ The shipped patch kills all known variants at the core, but AI-assisted variant-hunting is now a demonstrated capability. Assume follow-on disclosures in this codebase, and budget patch-velocity accordingly.

  2. The end-of-life cliff is now an active exploit surface. Minimal source backports exist only for PHP 7.4–8.1, and nothing official at all for 5.4–7.3.⁴ Every organization still running those branches — and in the long tail of the web, that's a lot of organizations — is now defending a known, named, 9.2-rated RCE with no vendor fix. Watch for a wave of emergency migrations, hosting consolidation, and possibly acquisitions of "unfixable" properties at distressed prices.

  3. The patch gap is measured in attacker-minutes. Exploitation attempts began October 17, before disclosure; Amazon now assesses broad in-the-wild exploitation with multiple actors.⁴ The exposure window for any unpatched host isn't "since the news broke" — it's days-to-weeks of quiet probing you may not have logged. If you patch this week and declare victory without hunting back to the 17th, you may be certifying an already-breached system.

  4. AI-assisted discovery cuts both ways, permanently. This round, defenders found it first — because OpenAI, Wiz and Calif chose to spend frontier models on finding. Wiz itself warns that as exploit development collapses from months to hours to minutes, "vulnerabilities that once seemed impractical to exploit become viable targets."³ The same dynamic applies to every other long-neglected dependency in the global software supply chain. Log4Shell taught this lesson about dependencies in 2021; PHP2Shell just taught it about time. Nothing is safe because it has survived this long.

🎯 The Bottom Line

PHP2Shell isn't a PHP story — it's a story about the collapse of difficulty as a security strategy. For twelve years, a CVSS 9.2 flaw in the language running 70% of the web was kept in check by nothing but the grinding complexity of exploiting it; AI erased that in a week. Patch your PHP to 8.5.12/8.4.27/8.3.36/8.2.35 or take it offline, hunt your logs back to October 17, and then go through your risk register and strike out every line that says "too complicated to be worth attacking." That category of protection no longer exists.

📚 Verified Sources

  1. CISA — "Critical Vulnerabilities in PHP Require Immediate Patching" (Alert, October 21, 2026): CVE IDs, fixed versions, patch-or-offline guidance. https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
  2. CNN Business — "Websites shut down globally after AI finds a critical flaw affecting 70% of the internet" by Lisa Eadicicco & Hanna Ziady (Published Oct 21, updated Oct 22, 2026): UK/Japan/EU government responses, ANA/JR West/MUFG suspensions, Wikimedia and The Journal takedowns, Wiz and deVere Group quotes. https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai-intl
  3. Wiz Research — "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet" (October 21, 2026): primary technical writeup — PHP 5.4+ lineage, WordPress/Drupal/Joomla RCE demonstrations, memory disclosure of passwords/tokens/keys, the AI inflection point, models used, mitigation signals. https://www.wiz.io/blog/php2shell-php-rce
  4. Tenable — "php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities" by Satnam Narang (October 21, 2026): disclosure timeline and CVE leak, CVSS v4.0 9.2 ratings, Amazon Threat Intelligence's October 17 exploitation observation, fixed-version matrix, W3Techs 69.3% share, exposed-host estimates, Cloudflare CTO quote, CERT-EU 2026-018. https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote

All claims verified against Gold-tier (CISA) and Silver-tier (Wiz Research, CNN Business, Tenable) sources. Each source URL was scraped and confirmed accessible on October 22, 2026. The Washington Post and BleepingComputer were attempted and discarded after failed scrapes (stream error / 403), per verification protocol. Researcher host-count estimates (1.3M/1.9M) are labeled as estimates; conflicting exploitation observations (CISA vs Amazon Threat Intelligence) are presented with both views. Last verified: October 22, 2026.

Complexity was the last free security control. As of October 21, 2026, the invoice arrived. 🎯

Back to Technology News
·