A PHP vulnerability, hidden in the programming language upholding 70% of the internet, spurred governments and organizations to update their software.
On October 21st, 2026 the world learned about one vulnerability that sent cybersecurity experts across the globe scrambling to update their systems. The PHP hack, which was publicly disclosed a month after its discovery, sent shockwaves through the security field due to the massive reach of the vulnerability and the corresponding impact that use of the exploit could bring. PHP (Hypertext Preprocessor) is an open-source programming language that has served as the backbone of several sites since it was created in 1994. The researchers who uncovered the vulnerability, Wiz, explained that PHP “powers 70% of all websites in the world”, from online shops, to WordPress, and even Wikipedia. The ubiquitous language converts the data retrieved when a site is visited into something that can be read and viewed, and has been integrated into programs that develop websites and web apps.
The find was aided by artificial intelligence models Wiz Atlas, Google’s Gemini 4 Argon, and OpenAI’s GPT-5.6 Sol. The tools identified two CVEs (Common Vulnerability and Exposures), CVE-2026-109618 and CVE-2026-209619, that they grouped under the vulnerability name PHP2Shell. Both CVEs ranked 9.2 out of 10 for their severity. According to Wiz, these “vulnerabilities can allow unauthenticated attackers to execute code on affected servers or read sensitive process memory. That memory may contain passwords, authentication tokens, API keys and certificates belonging to other requests or the server itself.” Using the CVEs, a potential threat actor could access the sensitive process memory without ever using remote code - just by ending a request to PHP unexpectedly. This “stale state” caused by the frozen request could even allow a threat actor to run malware. One researcher who discovered the vulnerabilities, Ryan Austin, called PHP2Shell “the most serious vulnerability I’ve ever found”.
Though potentially catastrophic, the issue lay undetected in PHP for over a decade until Calif, a cybersecurity firm that works in security engineering and securing AI, joined OpenAI’s Patch the Planet Initiative. There, they used GPT-5.6 to test the security of PHP and found viable exploits after years of a similar vulnerability being found and left alone since exploitation had not yet been proven. Around the same time, Wiz Researchers were also investigating the vulnerability, with one investigator Sagi Tzadik, saying that his work with an AI agent in August identified the crucial vulnerability, something that he initially considered it to be a hallucination. After the two organizations realized the vulnerability, they reported it to PHP and teamed up to develop a patch by late August, a patch that became publicly available the same day as the public disclosure about PHP2Shell - October 21st, 2026.
After a month of hard work by the researchers and security engineers, the patch being released one month after discovery should have been enough to secure PHP-dependent sites and apps - but there was another issue in the patch rollout that could have seriously damaged the work the researchers put into quietly solving the issue. Just two days before the planned release, there was buzz about the PHP flaw online which pushed the PHP maintainers to accelerate the release schedule by one day. Adding to the scramble, Calif accidentally shared a view showing how the exploit worked - while the patch was still private. The timing was not as bad as it could have been, with Wiz CTO of exposure management and appsec, Timer Schwartz, remarking that: “If it had leaked a month earlier, this would have been a very different situation”. Still, the video led to millions of attempts across the web to repeat the exploit, forcing sites (including WIkipedia and federal websites) to come offline to prevent hacks before the update had been installed. What’s more, Chainguard, a computer and network security company that “guard(s) open source software from what could go wrong” released built images showing the PHP fix, which the PHP foundation explained meant threat actors “could now study the fix in the binary form while every other PHP user was still waiting for the release.” The foundation denounced the act, as it “disregarded weeks of work by many parties toward a coordinated disclosure.”
The exploit leak and the PHP patch published shortly after triggered a flurry of action on October 21st, internationally and internationally. In the US, the Cybersecurity Infrastructure and Security Agency (CISA) released an alert urging companies to patch the vulnerabilities and take sites and apps using the old PHP version that cannot be patched yet offline until they can be updated. The National Security Agency also issued an advisory encouraging patching and also asking organizations to look at taking other mitigation measures, like “adding enhanced logging within network/operational environments”. The UK’s National Cyber Security Centre (NCSC) similarly shared an alert with six recommendations, adding to the NSA’s advisory by suggesting organizations look out for other updates from third-party software vendors that also rely on PHP.
The European Union (namely, the European Commission, ENISA, the EU Agency for Cybersecurity, CERT-EU, Europol EC3, and the EU national computer security incident response teams (CSIRTs network) came together on a joint statement telling organizations to update systems, making sure to prioritize internet-facing networks. Reuters reported on the many websites across the continent being taken down across the continent - the Netherlands’ “government portal Overheid.nl, the national soccer association KNVB, the websites for the country's five largest political parties and several hospital websites” where all taken offline. Denmark’s IT company Kombit stopped several services, Finland’s IT service provider Valtori shut down government public network services, and France reported that all its sites were put under preventative maintenance.
Further west, more countries issued orders about the vulnerability. Russia’s Federal Security Service (FSB) instructed critical infrastructure organizations to update software to fix the PHP vulnerability - and to temporarily shut down the sites if they don’t have time to do so, on October 22nd. In China, and Hong Kong specifically, the industry ministry also told organizations to make the update on the 22nd, while recommending changes to account passwords and keys and improved cybersecurity monitoring. In Japan, officials recommended the same updates as other countries, and took down services like their emergency alert system while patching their software. Ryosei Akazawa, Japanese industry minister, suggested that these measures could be improved: “An attack can succeed by getting through just one hole… for that reason it’s important we shift our mindset and think from the perspective of the attacker. Defenders also need to make use of AI and respond proactively, staying one step ahead.”
PHP2Shell has put a spotlight on the use of AI in cybersecurity. While AI models were key to the discovery of the flaw, some anxiety about potential exploits came from the ability of cybercriminals to use AI and automate intrusions with the vulnerability. In a podcast with TechCrunch, Wiz’s Schwartz warned that patching by hand may not be sustainable on a larger scale, and that the older, foundational code for the internet - like PHP - may lead to a “vulnpocalypse” especially as AI lowers the effort and skill needed for cyberattacks. The leak about PHP2Shell was also reminiscent of cybersecurity concerns around another vulnerability-detecting AI model - Anthropic’s Mythos AI falling into the hands of cybercriminals. These worries even led to Mythos AI being temporarily banned. Whether or not AI will be the answer to more vulnerabilities, the PHP foundation holds a “cautiously optimistic outlook” for the future. You can find instructions on how to update PHP here.