Full Breakdown
AI-Discovered PHP Flaws Prompt Global Website Shutdowns and Rapid Patch Race
By Drooid · · How we work
Core Event: Critical PHP Vulnerabilities Uncovered and Publicly Disclosed
Two remote-code-execution flaws in PHP—CVE-2026-109618 and CVE-2026-109619—were disclosed on October 22, 2026 with a severity of 9.2/10. The bugs let attackers run arbitrary commands on vulnerable servers without authentication, enabling data theft, content alteration, or site outages.
Background & Context
PHP powers roughly 70 % of identifiable web sites, including WordPress, Drupal and Joomla. The flaws had lingered for years, hidden from human analysis. AI models finally exposed them: security firm Calif used OpenAI’s GPT-5.6 Sol to report the first flaw on August 11, and Alphabet-owned Wiz reported the second on August 24.
Timeline
- August 11 – Calif discovers the first vulnerability.
- August 24 – Wiz discovers the second.
- October 21 – PHP developers release emergency patches (8.5.12, 8.4.27, 8.3.36, 8.2.35) and an advisory.
- October 22 – Public disclosure triggers worldwide patching; the NSA urges immediate updates or temporary shutdowns.
Data & Statistics
- PHP is used by about 70 % of websites whose server-side language is known.
- Cloudflare saw thousands of exploitation attempts in the ten hours before disclosure, rising to tens of thousands within 45 minutes, hundreds of thousands within two hours, and millions thereafter.
- Amazon’s threat-intelligence team logged a honeypot attempt on October 17.
- South Korea may have 112,000 vulnerable servers, ranking sixth globally in exposure.
Official Statements & Responses
- The NSA advised immediate patching or offline isolation of affected systems.
- The FBI Cyber Threat Division warned the flaws could enable remote malware insertion.
- The PHP Foundation posted “update now” instructions on php.net.
- Ministries in Germany, France, the Netherlands and Finland temporarily disabled public-facing sites while applying fixes.
- Cloudflare deployed WAF rules to block malicious requests.
On-the-Ground Reports
- The Wikimedia Foundation shut down several services for updates.
- The Port of Rotterdam, Dutch hospitals and the French Ministry of the Interior entered preventive maintenance mode.
- Japan’s Prime Minister Sanae Takaichi posted a social-media alert urging operators to verify PHP versions.
Verbatim Quotes
- “People knew something weird was going on. But no one could really find a way to write an exploit — of turning a bug that might cause a computer to crash into something really bad that would allow somebody to run software that they weren't supposed to be able to run on a computer,” — Robert McMillan, street-journal reporter
- “That whole gap between the patch being available and attackers getting to exploit that before anybody patches, that's the whole game essentially,” — Andrés Guerrero-Saade, SentinelOne
- “ "Two critical security flaws were discovered in PHP that could allow hackers to take control of vulnerable website servers and potentially steal customer information, change website content, install malware or take the website completely offline.” — Voldemaras Kadys, Mediatech
Why It Matters
The incident shows how AI can speed both discovery and exploitation of vulnerabilities. The surge in attacks after disclosure highlights the narrow window organizations have to patch critical software, lest personal data—email addresses, physical addresses, names and dates of birth—be exposed.
What’s Next
- The NSA and FBI will keep monitoring exploitation and issue further guidance as needed.
- PHP maintainers plan a broader code-base audit for AI-detectable weaknesses and future updates.
- Organizations should verify their PHP versions, apply the October 21 patches, and add intrusion-detection measures.