Critical PHP Flaws Trigger Millions of Hacking Attempts and Worldwide Website Shutdowns

Two critical vulnerabilities in the PHP programming language have triggered a global cybersecurity response, with millions of exploitation attempts reported so far and organizations temporarily taking websites and online services offline.

The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively known as PHP2Shell, were disclosed on October 21; both received a severity rating of 9.2 out of 10. These flaws can allow unauthenticated attackers to execute malicious code on vulnerable servers, potentially enabling server takeover, data theft, and service disruption.

The vulnerabilities stem from memory-handling errors in PHP itself, rather than individual applications built on the language. This broadens the potential impact, as PHP powers around 70% of websites with known server-side tech, including sites built on WordPress, Drupal, Joomla, and Magento.

Researchers at Calif, OpenAI, and Wiz discovered the flaws, with AI models helping identify weaknesses that had gone undetected for more than a decade. OpenAI’s GPT-5.6 Sol model helped uncover the vulnerabilities, and the company initially reported them privately so developers could prepare fixes, but details leaked online before the planned disclosure and patch release.

The subsequent rush to secure systems disrupted online services across multiple countries. The Netherlands and Finland temporarily took government websites and other public-facing services offline. Organizations in France and Japan also suspended access to some websites and services as a precaution. The BBC also has live reporting on the situation with UK government websites.

Cloudflare CEO Matthew Prince reported a sharp rise in exploitation attempts on his X account, from thousands in the 10 hours before public disclosure to tens of thousands within 45 minutes, hundreds of thousands within two hours, and millions by October 22. Cloudflare deployed protections against the PHP2Shell vulnerability on October 21 at 3:02 am UTC. Amazon Web Services also reported detecting an attempted exploitation of the vulnerabilities on October 17, four days before their public disclosure. These reports indicate widespread attack activity, although attempts do not necessarily mean successful breaches.

The PHP security team has released emergency patches, urging users to update immediately. Fixed versions include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Organizations running older, unsupported versions may need vendor-provided fixes or an upgrade to a supported release. Security providers have also introduced protections to help block exploitation attempts.

The incident raises much broader concerns about the growing speed of AI-assisted vulnerability discovery and exploitation. As security researchers use AI agents to identify flaws in widely deployed software, attackers may also develop exploits faster, leaving organizations less time to respond.

The AI Advocate at Sumsub has shared his opinions on the topic: