✦
Two critical flaws in PHP, the programming language behind most of the world's websites, forced governments and companies around the world to take websites offline in October. The flaws, now known as PHP2Shell, were found with the help of artificial intelligence and patched on 21 October.
The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and both were rated 9.2 out of 10 for severity. They could allow an attacker to run commands on a vulnerable server without logging in, a type of flaw known as unauthenticated remote code execution. The PHP project called both flaws critical and rushed out emergency patches after the details leaked before the fix was ready.
The flaws were discovered by researchers at two security firms, Calif and Wiz, as part of a programme started by OpenAI called Patch the Planet. Wiz said the flaws were the most severe vulnerabilities ever discovered by AI, and researchers said frontier AI models were critical to developing working exploits across several applications in hours. One researcher at Calif said it was the most serious flaw he had ever found.
PHP powers around 70 percent of websites worldwide, according to Wiz, a figure the BBC said it could not verify. The language sits behind WordPress, Drupal and Joomla, along with countless shops, forums and company sites. When the patches arrived, organisations that could not apply them quickly were advised to take their sites down as a precaution, and many did.
In the UK, 32 government services were reported unavailable, with four more partly affected. Finland shut down government web services, the Netherlands' cyber agency took its own site offline, and government sites in France, Denmark and Belgium were also affected. Parts of Wikipedia were unreachable at times, and companies including the airline ANA and the brewer Asahi paused services in Japan. No successful breaches had been confirmed when the patches were released.
Source: MSRX
