PHP2Shell: AI finds decade-old flaw in software behind 70% of websites; governments take sites offline
A large chunk of the internet went offline on Wednesday, and most of it was switched off on purpose. Government websites in the Netherlands, Finland, France and Denmark, along with universities, hospitals and sites as big as Wikipedia, pulled systems down after two serious security flaws were found in PHP.
Most people have never heard of PHP, but it is the software running behind roughly 70% of all websites, from news sites and online shops to personal blogs.The flaws, now nicknamed PHP2Shell, let a hacker take over the computer that runs a website without needing a password. They had been hiding in PHP's code for more than a decade, and it took artificial intelligence (AI) to find them. PHP's developers released a fix on October 21, but hackers moved within hours to attack websites that hadn't updated yet.
Cyber security agencies in the US and the UK have told website owners to install the fix right away or take their sites offline until they can.The list of affected sites shows how far PHP reaches. The Dutch government's own cyber security agency shut its website as a precaution. Finland took several government online services offline, France's Interior Ministry put all its websites into maintenance mode, and Denmark shut its national school communication platform.
In the Netherlands, the Port of Rotterdam, the national football association, several hospitals and the five largest political parties also took their sites down.
The Internet Archive went offline briefly, and online forums 4chan and DeviantArt ran into trouble. Even Pokémon Home and Pokémon Champions were taken offline.Some world leaders got involved too. Japanese Prime Minister Sanae Takaichi posted on X: "We have an urgent request for everyone to take action tonight."The rush makes sense once you see how fast hackers moved. Cloudflare, a company that sits in front of millions of websites to protect them, saw thousands of hacking attempts even before the flaws were made public. CEO Matthew Prince said in a post on X that this climbed to tens of thousands within 45 minutes of the announcement, hundreds of thousands within two hours, and millions by the next morning.
PHP is the hidden software behind most websites on the internet
Think of a website as having two sides. The side you see is the page in your browser.
The side you don't see is a computer, called a server, that builds that page every time you open it. It fetches the right text, images, prices or comments from a database and sends the finished page to your screen. PHP is the language that does this job for a huge share of the web.It has been around since the early 1990s, and it powers WordPress, the tool behind millions of blogs and business websites. It also runs Wikipedia, many government portals, and platforms like Drupal and Joomla that big organisations use to manage their websites.
Web tracking firm W3Techs estimates PHP is used by about 69.3% of all websites whose underlying software it can identify.That is why a single flaw in PHP turned into a global problem. Tiffany Farriss, who heads the Drupal Association, told Reuters that any server running a version of PHP from the last 20 years would be vulnerable. "This issue impacts the majority of the internet," she said.PHP is also free and open source, which means anyone can use it.
It is looked after by a small non-profit, the PHP Foundation, which has just 13 full-time and part-time engineers maintaining software that much of the internet depends on.
The PHP2Shell flaw lets hackers take over a website without a password
Normally, to change a website or access its stored data, you need an administrator login. PHP2Shell skips that step entirely.The two flaws, officially tracked as CVE-2026-109618 and CVE-2026-109619, are both rated 9.2 out of 10 for severity.
In simple terms, a hacker can send a website a carefully crafted request that makes PHP run out of memory and stop halfway through its work. That leaves behind some leftover data in the server. The hacker then sends a second request that makes PHP use that leftover data as if it were normal, and that opens the door to running their own commands on the server.Once inside, a hacker can change what a website shows, plant malicious software that infects visitors, or steal what the server stores.
That can include usernames and passwords, digital keys that connect the site to other services, and databases with personal information. A second route even lets hackers peek into the server's short-term memory, where they could catch passwords and login details of other people using the site at the same time.Wiz, one of the firms that found the flaws, showed working attacks on fresh WordPress, Drupal and Joomla websites.
It also pointed out that the problem is in PHP itself, so even a basic website with nothing complicated on it can be at risk. Every version of PHP going back more than a decade is affected.
AI found a flaw that had been hiding for over a decade
The bugs were found by two security firms working separately. Calif says it spotted them on August 1 with the help of an AI model, which OpenAI says was its GPT-5.6 Sol. Wiz found them on August 19 using its own AI tool along with Google's Gemini 4 Argon and GPT-5.6 Sol.What stands out is that the flaws were not new. PHP's own developers had considered a possible attack along these lines in 2024, but nobody could work out how to make it happen. According to Wiz, turning these bugs into a real attack required so many complex steps that it was at the edge of what human experts could manage. With AI, a single researcher did in a week what would earlier have taken a top team months.The plan was to keep the flaws secret until October 22, giving website companies time to prepare fixes quietly.
That plan fell apart when details leaked on online forums and social media on Tuesday. PHP rushed its fix out nearly a day early. Amazon later said its systems saw a hacking attempt on October 17, four days before the public announcement, and nobody yet knows how that attacker found out.OpenAI said in a blog post that the episode shows how AI can uncover security flaws, but also how it can help attackers "rapidly develop offensive tools and exploits."
The same kind of AI that found the bug can help hackers study the fix and build an attack in very little time. That is why the window between a fix coming out and attacks starting has shrunk from days to minutes.
Most users on the internet can relax, but website owners need to update right away
If you only browse the web, there isn't much you need to do. The flaw targets the servers that run websites, not your phone or laptop. Still, a hacked website can be used to spread malware or steal data, so stay alert for a few weeks.
If a service you use asks you to change your password, do it through the official app or website. Be careful with emails or messages about the PHP flaw that ask you to click links or share details, as scammers often use big news like this as bait.If you run a website, even a small blog, check whether it uses PHP. Sites built on Squarespace or Wix are safe, as those platforms don't use PHP. Automattic, the company behind WordPress.com, says websites it hosts directly, along with Tumblr, are safe.
If you installed WordPress yourself or use a hosting company like GoDaddy, Bluehost or Hostinger, contact your provider to find out when the fix will reach your site.The fixed versions of PHP are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Websites running PHP 8.1 or older won't get a fix at all, because those versions are no longer supported, so they need to move to a newer version. If your site stores customer details or takes payments and you can't confirm it has been fixed, taking it offline for a few hours is the safer choice.
The UK's National Cyber Security Centre has also asked organisations that couldn't update quickly to check whether hackers have already left a hidden way back into their systems.Small websites run by individuals and small businesses are the most at risk, since they often lack a technical team and depend on their hosting company to apply fixes.Sigi Goode, a professor of information systems at the Australian National University, told The Guardian where the real danger lies. "The bigger concern is the websites that are not down today," he said. The websites that went dark on Wednesday were the ones taking the threat seriously. The ones still online without the fix are what hackers will be hunting for in the weeks ahead.