AI Finds Two Critical Flaws in PHP, Sending Most of the Web Scrambling to Patch

Updated 15:56 UTC, Oct 22, 2026: Exploit attempts climb into the millions, 32 UK government services offline

Attackers moved within hours of the disclosure, and the numbers kept rising. Cloudflare chief executive Matthew Prince said on X late on Wednesday that his network saw thousands of attempts to exploit the flaws in the 10 hours before they were publicly announced. That jumped to tens of thousands in the 45 minutes after the announcement, hundreds of thousands within two hours, and millions now. Cloudflare said attackers are also changing their payloads to try to slip past its firewall protections, and stressed that those protections are no substitute for patching.

Amazon says the first attempt came before the flaws were public at all. Amazon Threat Intelligence said it detected an attempt to exploit php2shell on October 17, four days before the patches were released, picked up by MadPot, its network of honeypots. The flaws were still under embargo at the time, and Amazon said it remains unclear how the actor got the exploit information early. It found several proof of concept exploits on October 21 from about 0200 UTC, some 12 hours before the patches landed, and is advising organizations to check for suspicious activity dating back to at least October 17.

In Britain, the count of services pulled offline became clear on Thursday. Tech minister Baroness Lloyd of Effra told the House of Lords that 32 government services are unavailable and four are partially unavailable, largely because of precautionary measures taken while security updates are applied. Downing Street said no large public facing critical services have been affected, that some limited websites have gone dark while the work is done, and that the outages do not mean the services were hacked. The National Cyber Security Centre urged organizations to update to a fixed version of PHP, or consider taking their websites offline if they cannot upgrade immediately, and called the scale of the issue unprecedented. The Office for Budget Responsibility took its site offline, pages for some BBC programmes became unavailable, and Oxford City Council and the City of Edinburgh Council took their websites down on Wednesday.

The patch rush widened across Asia on Thursday, Reuters reported. Mitsubishi UFJ Financial Group, the Japanese lender, said it was temporarily suspending some internet services because of emergency measures. Japan's Finance Ministry also suspended some website content and online services while it put security measures in place. China's industry ministry urged organizations and users to inspect their systems immediately, upgrade to the latest secure version of PHP, strengthen monitoring, and promptly change accounts, passwords and keys. South Korea raised its private sector cybersecurity alert level and activated emergency response measures, citing a higher risk of hacking attacks.

Two critical flaws in PHP, the software that runs about 70 percent of the world's websites, were made public on Wednesday, October 21, and website owners around the world rushed to install emergency fixes. PHP's developers released updated versions the same day and told every user to update immediately.

The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and researchers call them php2shell together. Both carry a severity score of 9.2 out of 10. PHP runs behind the scenes on servers for sites built on platforms such as WordPress, Drupal and Joomla.

What the flaws do

The flaws sit in how PHP handles errors when it processes web requests. If a request is too large and PHP runs out of memory, the software fails to release the memory it tried to use, Cloudflare explained in its own write-up. An attacker who manipulates the data in that memory can crash the process, read sensitive information held on the server, or run code of their own on the machine, all without logging in.

Wiz, the security firm owned by Google parent Alphabet, said it had shown working attacks against WordPress, Drupal and Joomla installations, and could read passwords and access credentials from a server's working memory. Palo Alto Networks unit Unit 42 counted more than 22.6 million internet-exposed systems that could be vulnerable. Not every PHP site can be exploited, because setups differ, but PHP's developers said all installations handling web requests are at risk.

AI found the flaws, and a leak sped up the clock

Security firm Calif found the first flaw using OpenAI's GPT-5.6 Sol model and reported it to PHP on August 11, 2026, according to Reuters. Wiz found the flaws independently and reported a second one on August 24, 2026, also using AI models. The fixes were being prepared under wraps until details leaked on the Hacker News forum on Tuesday, October 20, 2026. PHP's developers then moved the release up by a day, leaving site owners little time to get ready.

OpenAI called the flaws one of the most impactful security issues in recent memory, and said it worked with the White House Super Intelligence Force, the Office of the National Cyber Director and the Cybersecurity and Infrastructure Security Agency so that guidance reached the operators of critical services. The White House said on Wednesday that it was working to expedite the release of the fix and to protect American networks.

Governments pull sites offline rather than risk it

The NSA, the FBI and CISA urged organizations on Wednesday to patch at once, and to take systems offline if they could not be secured promptly. The NSA said flaws of this kind often give an attacker a direct path to a server's file system or database. Cyber agencies in the United Kingdom, Canada, Australia and the European Union issued similar warnings. The government of Finland and the Dutch House of Representatives disconnected sites from the internet on Wednesday while they updated.

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Updating WordPress or another app does not update the PHP underneath it, so owners need the server package itself updated, or word from their hosting provider that it has been done. Cloudflare said it had put firewall rules in place to shield its customers. Threat watchers at watchTowr and Sophos said criminals were already discussing the flaws and testing for openings, though no successful attack had been confirmed by Wednesday afternoon.