On October 21, 2026, websites around the world suddenly went offline. Government portals, online archives and other major services were temporarily shut down as administrators raced to install emergency security patches.
The cause was not a traditional internet outage. It was the discovery of two extremely dangerous vulnerabilities in PHP, the programming language used by a large portion of the web.
The flaws, collectively named PHP2Shell, could allow an attacker to execute malicious code on vulnerable web servers without first logging in.
What made the story extraordinary was how the vulnerabilities were discovered: artificial intelligence helped cybersecurity researchers identify flaws that had remained hidden in PHP for years.
Researchers working with OpenAI's technology and Google's Wiz independently identified critical weaknesses. PHP maintainers then coordinated emergency fixes with security companies and infrastructure providers.
But the same technology that helped defenders discover the bugs also raised fears that attackers could rapidly develop exploits.
So which websites went offline? Was WordPress affected? Were millions of websites hacked? And what should website owners do now?
Here is what happened, what has been confirmed and what the incident reveals about the future of AI-powered cybersecurity.
Table of Contents
- What Happened on October 21?
- What Is PHP2Shell?
- How Did AI Discover the PHP Vulnerabilities?
- Which Websites Went Offline?
- Why Were Websites Taken Offline?
- Timeline of the PHP Security Emergency
- How Dangerous Were the Vulnerabilities?
- Were Websites Actually Hacked?
- Were WordPress Websites Affected?
- Which PHP Versions Need Patching?
- What Website Owners Should Do
- Are Blogger and Hosted Websites Affected?
- What This Means for AI and Cybersecurity
- Frequently Asked Questions
- Final Verdict
- Sources and Further Reading
What Happened on October 21, 2026?
On October 21, PHP's security team released emergency patches for two critical vulnerabilities identified as:
- CVE-2026-109618
- CVE-2026-109619
Both vulnerabilities received a critical CVSS 4.0 severity score of 9.2.
They affected PHP itself, not just a particular WordPress plugin or website theme.
That distinction was extremely important.
When a vulnerability exists in a single plugin, website owners can often disable or update that plugin.
But when the vulnerability is inside PHP, it potentially affects many different applications running on vulnerable versions of the programming language.
PHP powers websites built with WordPress, Drupal, Joomla, Magento and numerous custom applications.
Security agencies advised organizations to patch immediately or temporarily take vulnerable services offline when patches could not be applied safely.
Important distinction: The emergency shutdowns were largely defensive actions. A website going offline during the PHP2Shell incident does not mean attackers successfully compromised it.
What Is PHP2Shell?
PHP2Shell is the name given to two critical vulnerabilities in PHP's core runtime.
The name refers to the possibility of turning a vulnerable PHP web server into a system that executes commands supplied by an attacker.
What Does Remote Code Execution Mean?
Remote code execution, often abbreviated RCE, is a security problem that allows an attacker to run instructions on another computer or server.
In a severe case, an attacker may be able to:
- Run malicious programs.
- Access sensitive files.
- Steal passwords or authentication tokens.
- Install persistent malicious software.
- Modify website content.
- Disrupt website operations.
- Use the compromised server to attack other systems.
The exact consequences depend on the server's permissions, configuration and security controls.
How Did the PHP Bugs Work?
The vulnerabilities involved PHP's handling of memory when web requests encountered certain errors.
Computer programs temporarily allocate memory while processing information. That memory must be managed correctly, particularly when a process fails unexpectedly.
In PHP2Shell, certain error-handling conditions could leave memory in an unsafe state.
One flaw involved partially initialized data during out-of-memory handling. The other involved references to memory that had already been released.
These conditions could potentially be exploited to execute code or expose sensitive information.
The dangerous part was that exploitation could occur in PHP's request-processing components before a website's own application code had an opportunity to enforce its normal security checks.
How Did AI Discover the PHP Security Flaws?
This is the most remarkable part of the incident.
Artificial intelligence did not independently decide to attack the internet. Instead, cybersecurity researchers used advanced AI systems to investigate complex software code.
Two independent research efforts played important roles.
Calif and OpenAI's Patch the Planet Initiative
Security researcher Calif used OpenAI's GPT-5.6 Sol model as part of the Patch the Planet initiative to investigate PHP's codebase.
According to the researchers, the investigation identified a critical flaw on August 1, 2026.
The discovery was reported privately so maintainers could investigate and prepare fixes.
OpenAI later described a coordinated response involving PHP maintainers, security researchers, cloud infrastructure providers and government cybersecurity organizations.
Wiz Independently Discovered the Vulnerabilities
Google-owned cybersecurity company Wiz independently reported discovering the PHP vulnerabilities through AI-assisted security research.
Its research involved Wiz Atlas, Google's Gemini technology and OpenAI models.
Wiz's work helped establish the severity of the flaws and the risks they posed to internet-facing PHP servers.
Did AI Do Everything by Itself?
No.
AI helped researchers analyze complex software behavior, identify promising vulnerabilities and accelerate investigation.
Human security experts still played essential roles in validating findings, responsibly disclosing vulnerabilities, developing patches and coordinating protection.
What AI changed: It increased the ability of security researchers to inspect large, complicated software systems and uncover weaknesses that traditional review methods had missed.
That does not eliminate the need for experienced cybersecurity professionals. It changes the tools they can use.
Which Websites Went Offline During the PHP2Shell Emergency?
The incident affected public websites, government services and online platforms in multiple countries.
Reuters reported that several government organizations temporarily disconnected websites as a precaution.
Some major internet services also suspended systems while administrators investigated and applied patches.
| Website or Organization | Reported Impact | Important Context |
|---|---|---|
| Internet Archive | Briefly offline | Temporary security response |
| Wikimedia / Wikipedia infrastructure | Some systems temporarily taken offline | Not evidence that every Wikipedia page was unavailable |
| Dutch cybersecurity agency | Website temporarily offline | Precautionary shutdown |
| Dutch government services | Reported website disruptions | Organizations reviewed PHP exposure |
| French government websites | Some services temporarily unavailable | Security precautions and patching |
| Danish government websites | Reported disruptions | Response to vulnerability warnings |
| Finnish government websites | Some services temporarily offline | Precautionary security measures |
This table identifies examples reported during the incident, not a complete worldwide list.
It also does not mean every website listed was breached.
For the original reporting, see Reuters: Government Websites Go Dark After AI-Discovered Flaw.
Did Hundreds of Websites Go Offline?
Reports and community outage trackers documented hundreds of affected or temporarily unavailable services.
However, there is no single authoritative worldwide count of websites taken offline specifically because of PHP2Shell.
Some trackers include individual subdomains, supporting services and websites experiencing unrelated problems.
For that reason, the number of reported outages should not be confused with a verified number of successful cyberattacks.
Why Did Website Owners Take Their Sites Offline?
Taking a website offline may sound extreme, but it can be a reasonable emergency response when a severe vulnerability is publicly known and a system cannot be patched immediately.
Consider a government website that processes personal information.
If administrators believe its underlying server software could allow unauthorized code execution, keeping the website online may expose sensitive systems to unnecessary risk.
They may temporarily suspend the service while:
- Identifying affected PHP versions.
- Installing emergency security updates.
- Testing whether applications still function.
- Reviewing suspicious server activity.
- Confirming that the website can safely return online.
Some organizations also used web application firewall protections while preparing updates.
A temporary outage can therefore represent a successful precaution rather than a successful attack.
Timeline: How the PHP2Shell Emergency Unfolded
| Date | What Happened |
|---|---|
| August 1, 2026 | Calif reported identifying a critical PHP flaw with AI assistance. |
| Early October | Infrastructure providers and researchers prepared protective measures ahead of disclosure. |
| October 17 | Amazon later reported detecting an attempted exploit against a honeypot before public disclosure. |
| October 20 | Details of the vulnerabilities leaked before the planned coordinated disclosure. |
| October 21 | PHP released emergency patches. Organizations worldwide began urgent updates and precautionary shutdowns. |
| October 22 | Security providers reported large volumes of attempted exploitation while patching continued. |
| October 23 | Cloudflare discussed a related PHP session-upload-progress issue, CVE-2026-115560, requiring additional attention. |
| October 25 | Palo Alto Networks' Unit 42 withdrew an earlier claim connecting a government compromise to the specific PHP2Shell vulnerabilities. |
The timeline shows why coordinated vulnerability disclosure is difficult: defenders need time to prepare, but leaked technical information can accelerate exploitation attempts.
How Dangerous Was PHP2Shell?
Both vulnerabilities received a CVSS 4.0 score of 9.2, classified as critical.
The concern was not merely that websites might display errors.
Researchers demonstrated that the flaws could allow unauthorized code execution under certain conditions.
Why Was the Potential Impact So Large?
PHP is used by a substantial portion of websites worldwide.
Industry estimates commonly place PHP's share at roughly 70% of websites, although that is not the same as saying 70% of websites were successfully attacked or even necessarily exposed through a reachable vulnerable configuration.
The vulnerabilities were located in the PHP runtime itself.
That meant multiple content management systems and custom web applications potentially depended on affected software.
Could Attackers Steal Website Data?
Potentially, yes.
If attackers gained sufficient access to a vulnerable server, they might be able to read sensitive files or access information available to the compromised process.
However, a vulnerability's possible impact is not proof that any particular website experienced data theft.
Could a Hacker Take Over a Server?
Researchers demonstrated remote code execution against vulnerable PHP configurations.
The degree of control an attacker could gain depends on the privileges of the affected server process and other security measures.
Were Websites Actually Hacked?
There were documented exploitation attempts.
Amazon reported observing an attempt against one of its honeypot systems on October 17, four days before the public disclosure.
Cloudflare also reported attack traffic and attempts to modify malicious requests to evade protections.
But attempted exploitation and confirmed compromise are different things.
What Is a Honeypot?
A honeypot is a deliberately monitored system designed to attract or detect suspicious activity.
Security researchers use these systems to understand how attackers behave.
An exploit attempt against a honeypot is evidence of malicious activity, but it does not automatically establish that a real customer website was compromised.
An Important October 25 Correction
Palo Alto Networks' Unit 42 initially reported activity it believed might be connected to PHP2Shell exploitation against a European government organization.
On October 25, the company retracted that specific attribution because it could not confirm that the initial access involved the two PHP2Shell vulnerabilities.
What is confirmed: Critical vulnerabilities existed, working exploits were demonstrated, exploitation attempts were observed, and organizations temporarily shut down services.
What should not be assumed: That every offline website was hacked, that every affected server lost data, or that a particular reported breach was caused by PHP2Shell without supporting evidence.
Were WordPress Websites Affected by PHP2Shell?
Yes, WordPress websites running vulnerable PHP environments could be exposed.
However, PHP2Shell was not fundamentally a WordPress vulnerability.
WordPress is written largely in PHP, so its security depends partly on the version and configuration of PHP installed on the hosting server.
Why Updating WordPress Alone Is Not Enough
Website owners frequently update:
- WordPress core.
- Plugins.
- Themes.
Those updates are important, but they do not necessarily update the PHP runtime provided by the hosting company.
A website can have the latest WordPress version and still run an outdated, vulnerable PHP release.
Shared Hosting Customers
If you use shared hosting, the provider may manage PHP security updates.
Contact the host or check the hosting control panel to confirm that the website uses a patched version.
VPS and Dedicated Server Owners
Owners who manage their own servers are generally responsible for installing PHP updates, checking application compatibility and reviewing security logs.
Server administrators should follow PHP's official advisories and their operating system vendor's guidance.
Which PHP Versions Were Patched?
On October 21, the PHP security team released the following patched versions:
| PHP Branch | Emergency Patched Version |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
These versions addressed the two original PHP2Shell vulnerabilities.
Older, unsupported PHP releases may not receive official security fixes.
Operators should migrate away from end-of-life versions rather than assume that a firewall or temporary workaround provides permanent protection.
What About the Related Session Vulnerability?
On October 23, Cloudflare reported that PHP had issued information about another related vulnerability, CVE-2026-115560, involving session upload progress.
Cloudflare stated that the issue could affect even the PHP releases patched for the original two flaws.
This is a separate vulnerability and should not be confused with CVE-2026-109618 or CVE-2026-109619.
Website operators should follow the latest PHP security advisories and apply subsequent updates or appropriate mitigations rather than assuming the October 21 releases resolved every related issue.
What Should Website Owners Do Now?
If you own a WordPress website, online store or custom PHP application, the following steps can help you assess the situation.
- Identify your PHP version. Check your hosting dashboard or ask your provider which PHP version is running on the website.
- Confirm the security patch. Verify that your PHP branch includes the October 21 security fixes and any subsequent relevant updates.
- Update WordPress and other applications. Keep content management systems, plugins and themes updated separately from PHP.
- Check your hosting provider's advisory. Managed hosts may have already patched servers or applied additional protections.
- Review suspicious activity. If your server was exposed, consider having your provider or security team examine relevant logs and signs of compromise.
- Maintain verified backups. Store recoverable backups separately from the live website.
- Use layered security. Web application firewalls and access controls can reduce exposure but should not replace patching.
- Replace unsupported PHP versions. Older branches without security support require a migration plan.
For nontechnical website owners: Ask your hosting provider, "Has the PHP2Shell vulnerability been patched on my hosting account, and is my PHP version supported?"
You do not need to understand the exploit's internal mechanics to request a clear answer.
Are Blogger, WordPress.com and Other Hosted Websites Affected?
The answer depends on the underlying platform and who manages its server software.
Google Blogger
Blogger users do not install or manage PHP for the Blogger publishing platform.
Therefore, a Blogger site does not require its owner to apply PHP2Shell patches to Blogger's infrastructure.
However, external widgets, embedded applications or separately hosted services could have their own security issues.
WordPress.com
WordPress.com is a managed hosting service.
Its infrastructure provider manages server-level PHP maintenance, although customers should still follow platform guidance and keep any customer-managed components updated.
Self-Hosted WordPress
Self-hosted WordPress websites depend on the PHP environment supplied or managed by their hosting provider.
These website owners should verify that their hosting environment has received the relevant security fixes.
Static Websites
Purely static websites that do not run PHP on their serving infrastructure are not directly affected by vulnerabilities in a PHP runtime they do not use.
But external services, content management tools or administrative systems may still use PHP.
What Does PHP2Shell Mean for the Future of AI and Cybersecurity?
PHP2Shell demonstrates both the promise and the risks of increasingly powerful AI security tools.
AI Can Help Find Bugs Humans Have Missed
Large software projects contain enormous amounts of code.
Security researchers must understand complex interactions between memory, error handling, operating systems and application behavior.
AI-assisted analysis can help identify unusual patterns and accelerate the investigation of potential vulnerabilities.
The PHP2Shell discoveries showed how these capabilities can be used defensively.
AI Could Also Help Attackers
The same general capabilities that assist legitimate researchers can potentially help malicious actors understand published vulnerabilities and develop attacks.
That creates a race between patch deployment and attempted exploitation.
The PHP2Shell incident showed how quickly attack traffic can appear around a major security disclosure.
Responsible Disclosure Becomes More Important
When a vulnerability affects software used across the internet, researchers need to coordinate with maintainers, hosting providers and security organizations.
Publishing complete details before defenses are ready can create additional risks.
In this incident, the early leak complicated an already urgent response.
AI Will Not Eliminate Cybersecurity Professionals
AI tools can help identify flaws, but people still need to:
- Validate findings.
- Develop safe fixes.
- Test software compatibility.
- Coordinate vulnerability disclosure.
- Investigate suspected attacks.
- Decide when services must be taken offline.
The likely future is more collaboration between human cybersecurity experts and AI systems, not the disappearance of security professionals.
Related reading: Top Jobs AI Could Replace by 2030 and Why AI Hasn't Taken Your Job Yet.
Frequently Asked Questions About the PHP2Shell Security Emergency
1. What was the PHP security vulnerability discovered in October 2026?
Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were disclosed and patched on October 21, 2026. Together they are known as PHP2Shell.
2. Did artificial intelligence discover PHP2Shell?
AI-assisted cybersecurity research played a major role. Calif used OpenAI technology, while Wiz independently discovered the flaws using AI-assisted research tools. Human researchers and PHP maintainers validated and addressed the issues.
3. Which websites went offline because of PHP2Shell?
Reported examples included the Internet Archive, some Wikimedia systems and government websites or services in several European countries. Not every affected website was hacked; many were taken offline as a precaution.
4. Was Wikipedia hacked?
The reported temporary shutdown of some Wikimedia systems does not establish that Wikipedia was hacked. The organization took precautionary measures while systems were assessed and patched.
5. Were all WordPress websites vulnerable?
Not necessarily. Exposure depended on the underlying PHP version, configuration and other security controls. WordPress itself was not the source of the two core PHP vulnerabilities.
6. Did PHP2Shell affect 70% of websites?
PHP is used by roughly 70% of websites according to widely cited technology estimates. That does not mean 70% of websites were hacked or confirmed exploitable. The actual exposure depends on deployed PHP versions and configurations.
7. What does CVE-2026-109618 mean?
It identifies a critical vulnerability involving PHP's handling of certain out-of-memory error conditions, potentially allowing remote code execution.
8. What does CVE-2026-109619 mean?
It identifies a related vulnerability involving unsafe references to released memory, potentially enabling remote code execution or sensitive memory disclosure.
9. Can hackers steal passwords through PHP2Shell?
Successful exploitation could potentially expose sensitive server information, including credentials accessible to the compromised process. However, the existence of the vulnerability does not prove that passwords were stolen from any particular website.
10. Is PHP2Shell fixed now?
Emergency fixes for the original two vulnerabilities were released on October 21. Administrators must install patched PHP versions and continue following advisories for related vulnerabilities and subsequent updates.
11. Is Blogger affected by the PHP patch?
Blogger users do not manage a PHP runtime for Blogger's publishing infrastructure. They therefore do not need to install PHP patches for Blogger itself.
12. What should I do if my WordPress site uses old PHP?
Contact your hosting provider, confirm the installed PHP version and plan an upgrade to a supported, patched release. Back up your site and test compatibility before making major changes.
13. Did AI cause the website shutdowns?
AI helped researchers discover the vulnerabilities. The shutdowns were decisions made by website operators responding to security risks. AI did not directly shut down those websites.
14. Were there confirmed hacking attempts?
Yes. Amazon reported an attempted exploit against a honeypot before public disclosure, and Cloudflare observed attack traffic. However, not every reported attempted attack resulted in a confirmed compromise.
15. Could another AI-discovered vulnerability cause similar disruption?
Yes. Any widely used software component can contain serious vulnerabilities. As AI-assisted security research becomes more capable, more important discoveries may occur, making coordinated disclosure and rapid patching increasingly important.
Final Verdict: AI Helped Find a Major Internet Security Problem
The PHP2Shell emergency was one of the clearest demonstrations of how artificial intelligence is changing cybersecurity.
AI-assisted researchers helped uncover serious vulnerabilities hidden in software used across the internet.
Security teams then faced an urgent challenge: protect vulnerable websites before attackers could take advantage of the flaws.
Some organizations temporarily disconnected their services. Others deployed firewall protections and rushed to install emergency PHP updates.
The incident created real disruption, but it also demonstrated the value of responsible vulnerability discovery and coordinated security response.
The Bottom Line
AI did not take hundreds of websites offline. AI helped reveal a serious vulnerability, and many website operators took their services offline to protect them.
The bigger lesson is that artificial intelligence is becoming a powerful cybersecurity tool for both defenders and potentially attackers.
For website owners, the practical message is simple: keep server software updated, use supported PHP versions and never assume that updating a website's plugins is enough to secure its underlying infrastructure.
Sources and Further Reading
- Reuters — Government Websites Go Dark After AI-Discovered Flaw
- Reuters — Hacking Attempts Surge as Organizations Patch PHP
- OpenAI — Patch the Planet and Coordinated Disclosure
- Wiz — PHP2Shell Technical Research
- Cloudflare — PHP2Shell Firewall Protections and Related Advisory
- Huntress — PHP2Shell Vulnerabilities and Emergency Patches
- Palo Alto Networks Unit 42 — PHP2Shell Threat Brief and October 25 Correction
- PHP — Official Website and Security Releases
Updated October 28, 2026. This article distinguishes confirmed security findings from suspected compromises and reported precautionary website outages. Security guidance may change as researchers and software maintainers publish further updates.
