A critical security flaw in PHP, the programming language running an estimated 70% of the world's websites, has triggered one of the most urgent patching races the internet has ever seen. US agencies — including the National Security Agency and the FBI — warned on Wednesday, October 21, that the vulnerabilities, nicknamed "PHP2Shell," could let attackers take over web servers without ever logging in, and advised websites that cannot patch immediately to go offline.
File photo: server racks in a data center. The PHP2Shell flaws sit in PHP itself, so servers running the language are at risk even when a site's own code has no bugs.
A flaw at the foundation of the web
PHP is the behind-the-scenes code that builds a web page each time someone visits it. It pulls product listings, account details and login screens from a database and sends the finished page to the browser. It is free, maintained largely by volunteers, and underpins WordPress, Drupal, Magento and many hosting control panels — which is why a bug in PHP itself, rather than in any one website's code, carries such extraordinary reach.
The PHP Foundation first disclosed two critical security issues on Tuesday, October 20. Emergency patches followed on Wednesday morning around 10 a.m. ET, released in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The two bugs — tracked as CVE-2026-109618 and CVE-2026-109619 — are rated 9.2 out of 10 for severity. In plain terms, they can let an attacker run their own code on a vulnerable server with no login credentials at all.
"These are critical vulnerabilities and anyone using PHP should upgrade as soon as possible," PHP Foundation Executive Director Elizabeth Barron told USA Today.
What makes this episode especially dangerous is that details of the flaws leaked online before the planned disclosure date. Attackers and defenders found out at roughly the same time — collapsing the usual quiet window in which defenders patch before the world knows what to look for.
How artificial intelligence caught it
The vulnerabilities were uncovered with the help of artificial intelligence tools, in a chain of discoveries that spanned months. According to OpenAI, the bugs were first caught in July by researchers at Calif, a digital infrastructure defense firm, with help from one of OpenAI's most advanced models. Google's Wiz cybersecurity team then independently discovered and reported the vulnerabilities in August. OpenAI, Google and Calif completed a patch in early October.
"It could have been a really bad thing," Calif security researcher Bruce Dang told USA Today. "Imagine, nobody knew anything when — boom — today dropped. That would be extremely bad."
The White House, for its part, seized on the AI angle. The Trump administration said it was notified of the vulnerability on Friday, October 16, and is working with federal agencies and artificial intelligence companies to "expedite the release" of the fix to users and to protect American networks and critical infrastructure. In a statement, the White House said: "President Trump is committed to ensuring America leads the world in Super Intelligence, and this discovery demonstrates exactly why American leadership in SI is so critical," adding that "advanced SI technology helped identify a cybersecurity vulnerability, allowing experts to develop a solution that would mitigate widespread disruptions." Trump has pushed back against calls to regulate the rapidly growing AI industry.
File photo: the National Security Agency headquarters at Fort Meade, Maryland. The NSA and FBI warned that the flaws could allow server takeovers and urged immediate patching.
NSA and FBI warn: patch now, or unplug
On October 21, the National Security Agency's Cybersecurity Collaboration Center issued a rare, blunt advisory: organizations should identify every service that depends on vulnerable PHP, prioritize vendor fixes, increase logging, and replace unsupported services. Where an immediate update is not feasible, the advisory recommends taking the affected system offline until it can be fully mitigated.
Reports describe the warning as a joint NSA, FBI and CISA alert — the kind of three-agency message that does not happen often. The NSA said the flaws sit in PHP itself, not in a website's application or configuration, and warned of possible server takeover, information theft, disruption and access to other systems on the network.
The urgency was not hypothetical. Cloudflare, which sits in front of a large share of the world's web traffic, has already observed exploit attempts. "Cloudflare has observed exploit attempts, including spikes of thousands of attempts," Daniele Molteni, the company's director of project management, told USA Today. "We also saw attackers modifying their tactics to try to bypass protections."
Websites go dark across the US and Europe
As the disclosure broke, sites began going offline preemptively. Parts of Wikipedia were taken down or were partly offline while the Wikimedia Foundation worked to address the vulnerabilities, along with the bookmarking service Pinboard and the forums 4chan and Something Awful — each waiting for a fix.
In Europe, the disruption was broad. Reuters reported that in the Netherlands, government portals, the Port of Rotterdam and major hospital websites went offline, while public networks and school platforms in Finland and Denmark were disabled. In Belgium, government agencies, parliament, school platforms and major media websites ceased operations. The European Union's cybersecurity agency advised the immediate application of PHP security patches and recommended taking websites offline if updates were not feasible.
The episode is a scenario cyber insurers say they fear most: a single flaw that can hit thousands of policyholders at once.
File photo: computer code displayed on a screen. The PHP Foundation disclosed the two critical PHP2Shell vulnerabilities on October 20.
What this means
This is not a breach of one company or one website — it is a crack in the platform the web is built on. Because PHP itself is affected, a website can be at risk even if its own code contains no bugs at all. Every PHP installation serving web traffic is in scope, and analysts estimate more than 22 million internet-exposed instances could be affected.
The hardest-hit group may be those who cannot patch at all. PHP 8.1 and all older branches — including 7.x and 5.x — are end of life and receive no official fix. Hundreds of thousands of such installations are believed to still be online. Site owners on those versions must either upgrade or, as the agencies put it, isolate or take the systems offline. Configuration changes and web-application firewalls can reduce exposure but do not fully replace patching, PHP's developers warn.
The leaked disclosure is the other defining feature of this crisis. Coordinated disclosure is designed to give defenders a head start. When the details escape early, as they did here, attackers get the same blueprint as the people racing to fix it — which is why the NSA's advice skipped the usual "patch soon" and went straight to "patch now or unplug."
What happens next
The next days will be a raw race between patching and exploitation. The PHP community and hosting providers are pushing updates out now, and WordPress.com says its managed sites are already protected through infrastructure-level work with the PHP Security Team — though self-hosted WordPress site owners still must update the actual PHP runtime their servers run on, restart affected workers and verify the patched version.
Security teams are meanwhile being told to hunt for compromise on anything exposed since October 20: unexpected child processes from PHP workers, new web shells and unexplained outbound connections from web servers. The NSA, FBI and CISA message remains the same — inventory every PHP host, patch to the fixed releases, and treat end-of-life systems as emergencies.
For a flaw that sat undetected for more than a decade, the window in which the whole internet holds its breath is now. Whether PHP2Shell becomes a footnote about a crisis averted — or the start of a wave of server takeovers — will be decided by how fast millions of servers get patched in the coming days.
Post a Comment