On Wednesday morning, three of the most serious cybersecurity agencies in the United States spoke with one voice. The NSA, the FBI, and CISA all issued the same blunt instruction to anyone running a website: update your PHP now, or unplug your site until you can. Not next week. Not during the next maintenance window. Now.
The reason was a flaw so deep in the internet’s plumbing that it had been sitting there, unnoticed, for well over a decade. The researchers who finally found it were not human. They were AI models, and they found in weeks what fourteen years of human review had missed.
Within hours of the disclosure going public, the internet started going dark on purpose.
The scariest part is where it was hiding
The pair of vulnerabilities is called PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619. Both were rated 9.2 out of 10 under the CVSS v4.0 scoring system, which puts them squarely in the critical tier. The security firm watchTowr went further and rated them a full 10.0, the highest score possible.
Here is what makes PHP2Shell different from an ordinary bug. The flaws are not in WordPress. They are not in a plugin, a theme, or some sketchy piece of code a developer installed five years ago. They are in PHP itself, the open-source programming language that runs behind an estimated 70 percent of the world’s websites, including every major platform built on WordPress, Drupal, and Joomla.
Both bugs are memory safety problems in how PHP handles out-of-memory conditions and manages internal state between requests. In plain language: an attacker can send a specially crafted request to a vulnerable server and trick it into running their own code, no login required. Security researchers demonstrated exactly that, achieving unauthenticated remote code execution against both Drupal and a stock WordPress installation. Once an attacker can run code on your server, they can steal data, deface the site, install malware, or take the whole machine over.
The vulnerable code is estimated to date back more than a decade, possibly to 2012. Wiz, one of the firms that found the bugs, estimates around 1.3 million internet-connected hosts were exposed. So when the NSA and FBI tell the entire country to patch or pull the plug, that is the scale they are thinking about.
An AI found what a decade of humans missed
Three separate teams found PHP2Shell independently, and that alone tells you something about how findable these bugs were once AI got involved.
The first team was Calif, which reported the flaws on August 11, 2026, during an audit conducted under OpenAI’s “Patch the Planet” programme, using OpenAI’s GPT-5.6 Sol model. The second was Wiz Research, which reported on August 24 after using Gemini 4 Argon, GPT-5.6 Sol, and its own Wiz Atlas tool. The third was OpenAI itself, reporting on September 18. A PHP developer had actually noticed an early sign of the underlying out-of-memory problem back in a 2024 audit, but nobody connected it to a critical vulnerability until the AI-assisted researchers went digging.
The Wiz timeline shows how fast this moved once the machines got involved. Wiz researchers found the first bug on August 19. By August 20 they had demonstrated an unauthenticated hack against Drupal, and by August 21 they had done the same to WordPress. According to Wiz, frontier AI models made the whole process practical: discovery, exploit development, debugging, detection, and even patch validation. The report says Gemini 4 Argon, in particular, made a huge difference.
There is an irony here that should make everyone a little uncomfortable. The same AI power that found PHP2Shell is available to attackers too. Cloudflare CEO Matthew Prince shared the numbers publicly: his network saw thousands of exploitation attempts in the 10 hours before the vulnerabilities were publicly announced. That jumped to tens of thousands in the 45 minutes after the announcement, hundreds of thousands within two hours, and millions shortly after. Amazon confirmed that attackers were already probing for the flaws four days before disclosure.
Wiz put it plainly: AI now reduces the time and expertise needed to turn a bug into a working attack across many environments. Defenders get the same superpower. So do the people on the other side. If you are interested in how this AI-security arms race keeps escalating, our recent look at OpenAI’s own models going rogue is a useful companion piece.
The disclosure went sideways
The coordinated release was scheduled for October 21 at 14:00 UTC, with patched PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 ready to ship. PHP security had been warned in August and acknowledged the issue in September, so the fix was mature. What the plan did not account for was leaks.
Details started surfacing on October 20, a full day early: a thread on Hacker News forums, a post on X by the security firm watchTowr labs, and a proof-of-concept exploit video that Calif released by mistake. The GitHub security advisories went live at 13:34 UTC on October 21, 26 minutes before the announced release time, and PHP posted an early warning on php.net urging users to prepare. One security firm, Sansec, expected mass attacks to begin within 15 minutes of the release.
Then came a controversy that security people will be arguing about for months. At 07:41 UTC on October 21, roughly six hours before the coordinated release, the software supply chain company Chainguard published container images already containing the patch. The PHP Foundation accused Chainguard publicly of jumping the gun. Chainguard CEO Dan Lorenc did not dispute the timing but said the company moved after other vendors reported actual attacks and the coordinated channel had been informed. The uncomfortable truth is that publishing patched code early lets attackers compare old and new versions, diff the changes, and see exactly what to exploit on every unpatched server in the world.
There is also bad news for anyone running older PHP. Versions 8.1 and earlier are end of life and get no official binary fixes; the PHP team published source backports for 7.4, 8.0, and 8.1, and some Linux distributions and LTS vendors ship their own patched packages. Temporary mitigations exist, things like setting memory_limit to -1, lowering post_max_size, and disabling session upload progress, but PHP is explicit that these block only known attack paths. Updating, they say, is the only safe choice.
So the internet started pulling the plug
When the NSA, CISA, the FBI, and the UK’s NCSC jointly say “patch immediately or take your systems offline,” that is not normal advice. The FBI’s cyber division went further, warning that if operators could not update right away, they should take their websites offline until they could.
And so, remarkably, the internet complied. Parts of Wikipedia went dark. The forum 4chan temporarily disconnected. The hacker forum BreachForums voluntarily switched itself off, which is about as strong a signal of seriousness as you can get. The Finnish government’s websites were partly unavailable. Businesses in Japan and government services across Europe pulled sites while they checked their exposure. One system administrator on Reddit said it was their first deliberate website shutdown in twenty years.
To be clear, these shutdowns were precautionary, not confirmed mass compromises. WatchTowr was tracking exploit attempts online as of disclosure and had not confirmed a successful attack. But given that the flaw allows full server takeover with no login, nobody wanted to be the first headline.
What you should do right now
If you run a website, this is not a drill. The checklist is short and the window for action is the point of the story:
- Update PHP immediately to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on your branch, then restart Apache, PHP-FPM, and every long-running PHP worker. Patching without restarting does not count.
- Check for signs of trouble going back to October 17. Wiz suggests looking for odd multipart requests followed by out-of-memory errors, spikes in HTTP 500 errors, weirdly large or broken PHPSESSID cookies, and sudden PHP worker restarts.
- If you are on PHP 8.1 or older, upgrade now. There is no official fix coming for end-of-life versions, so check whether your host or Linux distribution has backported the patch, or move up.
- WordPress site owners: this bug is in PHP, not WordPress, so updating plugins changes nothing. Check your PHP version under Tools, Site Health, Info, Server, and ask your host to confirm you are on a patched release.
The bigger question nobody has answered
For fourteen years, this code ran under the eyes of the entire open-source world. It was read, reviewed, audited, and trusted. One developer even flagged a related symptom in 2024, and it still took an AI to connect the dots to a critical vulnerability. The uncomfortable question is not whether more bugs like this exist in the foundations of the internet. It is how fast the machines will find them, and who is holding the machines.
Sansec predicted mass attacks within 15 minutes of the patch release. Cloudflare watched attempts go from thousands to millions in hours. The window between “fix available” and “everyone is being attacked” is now measured in minutes, and it is shrinking. The PHP2Shell response was coordinated and fast, with the PHP team, Wiz, Calif, OpenAI, and cloud giants like AWS, Google Cloud, Cloudflare, Microsoft, and Akamai working together. The next decade-old bug might not wait for a disclosure schedule.
This story will keep developing as researchers track real-world exploitation, and it connects to a pattern we have been following: AI systems overstepping their bounds, AI platforms leaking private data, and Washington’s growing insistence that AI mistakes get reported like airplane crashes. The technology is accelerating on both sides of the firewall. This week, the defenders needed the help of the machines just to find a hole the humans had been standing next to for fourteen years.
The internet held its breath for a day, patched, and came back online. This time.
