AI Uncovers a Flaw Threatening 70 Percent of the World's Websites
Finn's Take· TL;DR- AI discovered two critical PHP vulnerabilities affecting 70% of websites; attackers gained advance exploit details, triggering emergency government responses globally.
- PHP2Shell flaws enable remote code execution on unpatched servers; NSA urged immediate patching or taking sites offline as preventive measure.
- Vulnerability highlights how AI accelerates threat discovery and exploitation, forcing faster security responses across public and private sectors worldwide.
A Hidden Danger Lurking in the Web's Foundation
A serious security vulnerability has been threatening websites worldwide — blogs, online stores, and news portals alike — and it goes all the way to the root: the PHP programming language itself, which the flaw allows attackers to use to take over entire servers. Artificial intelligence was used to pinpoint two vulnerabilities in PHP, a language used by more than 70 percent of websites on the internet. The scope of the problem is staggering, and the response has been equally sweeping.
The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, allow remote code execution and are together known as "PHP2Shell." Each flaw carries a CVSS v4.0 score of 9.2 — nearly the worst possible rating on a 10-point danger scale. Every PHP version released in the last decade is affected by at least one of these vulnerabilities, going back to version 5.4, and attackers can exploit them remotely, in some cases fairly easily.
How AI Found What Humans Missed for Years
The discovery itself is where this story becomes an AI story rather than a routine security bulletin. Reporting indicates that an organization called Calif identified the flaws with the assistance of an AI model referred to as GPT-5.6 Sol. Calif said in a blog post it found the flaws with the help of a large language model on August 1 and had been working on a fix ever since. Separately, the security firm Wiz independently discovered and reported both vulnerabilities on its own, without relying on Calif's findings.
On Tuesday, October 20, threat actors gained advance visibility into the two critical PHP vulnerabilities after details leaked ahead of the planned disclosure, accelerating the race between defenders and attackers. According to Amazon Threat Intelligence, its MadPot honeypot network recorded a PHP2Shell exploitation attempt as early as October 17, 2026, four days before the vulnerabilities were publicly disclosed. How the attacker obtained exploit details before disclosure is still unknown.
Governments Pull Websites Offline, Tech Giants Rush to Respond
On Wednesday, October 21, the vulnerabilities in PHP prompted a rare public warning from the United States National Security Agency (NSA), which advised taking websites offline if they could not be updated immediately. Cybersecurity agencies in Europe, Australia, Japan, and Britain urged PHP users to update immediately or take websites offline until patches could be applied. The response from governments was swift and dramatic.
In Germany, the Federal Ministry for Digital Transformation and Government Modernisation took some websites offline as a preventative measure, while France's Ministry of the Interior deactivated the official websites for local administrative offices. Authorities in Belgium, the Netherlands, Finland, and the Czech Republic also shut down websites to apply security patches. Meanwhile, on the private sector side, Cloudflare was part of a coordinated effort to deploy mitigations, developing and deploying web application firewall protections since early October 2026, roughly nine hours ahead of public disclosure.
What This Means for Everyday Users — and What Comes Next
The PHP team released fixes on October 21, 2026, in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Confirmed impacts of the unpatched flaws include unauthenticated remote code execution, memory disclosure — exposing passwords, tokens, and keys from other requests — similar in impact to the Heartbleed vulnerability in some paths. While these bugs won't directly compromise your phone or personal browser, the websites you use every day could be at risk if their administrators haven't patched yet.
PHP2Shell shows how AI is changing the threat landscape — attackers can now find and weaponize old flaws in widely used technology faster than ever before, and security experts recommend treating every PHP installation that serves web requests as at-risk. For web administrators who haven't acted yet, CERT-EU advises patching affected assets immediately, and where that is not feasible, organizations should consider isolating internet-facing applications from public networks until a fix is applied and verified. The PHP2Shell episode is a stark reminder that in an age of AI-assisted hacking, the window between discovery and exploitation is shrinking — and the internet's most foundational software is not immune.