Websites Go Offline Globally After AI-Detected PHP2Shell Vulnerability: Who is at Risk and What to Do

Websites Go Dark Over AI-Found PHP2Shell Flaw

For a few hours this week, pieces of the internet simply went quiet. Dutch government portals, a major Irish news site, Japanese airline and railway pages and parts of Wikipedia’s infrastructure disappeared behind maintenance notices. The cause was a pair of critical flaws nicknamed PHP2Shell, buried in the programming language that powers an estimated 70% of the world’s websites.

What makes the story unusual is how it surfaced. Artificial intelligence helped researchers turn bugs that had sat unnoticed for more than a decade into a working attack, and that is why agencies from the NSA to Europe’s CERT-EU reacted so loudly. A patch is now out. If you only browse the web, you do not need to install anything. If you run a website, the clock is ticking. Here is what happened, who is exposed and what to do next, including what it means for Nigerian site owners.

What Is the PHP2Shell Vulnerability?

PHP2Shell is the nickname for two critical security flaws, CVE-2026-109618 and CVE-2026-109619, in the core of the PHP programming language. Both score 9.2 out of 10 in severity. They can let an attacker run commands on a vulnerable web server without logging in, and fixes arrived on October 21, 2026.

PHP is the language that builds web pages behind the scenes before they reach your browser. It sits underneath WordPress, Drupal, Joomla and Magento, along with shared hosting platforms and control panels, which is why a flaw in its core reaches so far. Wiz, the cloud security firm that helped uncover the bugs, stressed that the weakness lives in PHP itself. Even a bare-bones “Hello World” page on an affected version can be vulnerable, however carefully its own code was written.

The two bugs trace back to what PHP does after a fatal error, especially when it runs out of memory. In the wrong circumstances the server can leave corrupted internal data behind, and a later request can reuse it. Attackers can exploit that to run their own code or, through a separate route, read slices of server memory that may hold passwords, tokens and API keys. Wiz, Calif and Cloudflare say every release from PHP 5.4 onward is affected.

How AI Found a Bug That Hid for a Decade

The unsettling part is how old this is. The PHP Foundation says a core developer spotted signs of the underlying memory problem back in 2024. In 2026, the security firm Calif and OpenAI independently reported a remote code execution flaw with the same root cause on August 11, and Wiz sent in its own findings on August 24.

Noticing a crash is one thing. Turning it into a dependable attack means chaining several bugs together and adapting to each server’s memory layout, painstaking work that has traditionally taken expert teams months. Wiz says it used Google’s Gemini 4 Argon, OpenAI’s GPT-5.6 Sol and its own Wiz Atlas tool, and that a single researcher finished in about a week what would once have taken a world-class team months. The company calls the episode an “AI inflection point” and compares it with Heartbleed in 2014 and Log4Shell in 2021.

Outside experts see a trade-off. Andrés Guerrero-Saade of SentinelOne told CBS News that the gap between a patch appearing and attackers exploiting it is “the whole game,” and that AI is shrinking that gap. Andrew Cullen, a University of Melbourne lecturer on AI and cybersecurity, told Al Jazeera that the same tools making the internet safer by fixing bugs also make it riskier by finding new ones to attack.

Defenders are using the same tools. The PHP Foundation said that earlier this year it worked with Alpha-Omega to scan PHP using Anthropic’s Claude Mythos, part of a wider effort to strengthen the project’s security.

The Week in Brief

• 2024: A PHP core developer first notices signs of the underlying memory problem.
• August 11: Calif and OpenAI independently report a remote code execution flaw with the same root cause.
• August 24: Wiz reports its findings to PHP’s security team.
• October 17: Amazon’s honeypots record the earliest known exploitation attempt.
• October 20: The CVE identifiers leak, CERT-EU publishes an advisory, and PHP pulls its October 22 release forward by a day.
• October 21: PHP ships patched versions, agencies urge immediate action and websites start going offline.
• October 22: Precautionary shutdowns continue, including Ireland’s The Journal, while Wikimedia and the Internet Archive work through fixes.

Which Websites Went Offline, and Why

The official response was unusually blunt. The NSA and Europe’s cybersecurity agency told organizations to act immediately, and the NSA warned that servers should either be patched at once or taken offline. CERT-EU, speaking jointly with the European Commission, ENISA and Europol, cautioned that some products may be vulnerable even when PHP runs unseen in the background. CISA, Canada’s Cyber Centre and Germany’s BSI issued their own alerts, and the FBI’s cyber division urged anyone unable to patch to take sites offline for now.

Plenty of operators listened. In the Netherlands, the national cybersecurity agency, the Port of Rotterdam, the Overheid.nl government portal, the football association KNVB, the five largest political parties and several hospital sites went dark. Finland’s state IT provider took government network services offline as a precaution, France’s Interior Ministry put its sites into preventive maintenance, and Belgium’s foreign affairs ministry briefly pulled its pages, though the country’s cybersecurity centre said it had recorded no attacks on Belgian websites. In Japan, ANA, JR West and the bank MUFG reported suspended pages or services, and Prime Minister Sanae Takaichi urged companies to check whether their public sites use PHP. South Korea raised its private-sector alert level and sent guidance to about 28,000 companies. Ireland’s The Journal and some Wikimedia systems also went offline for a time, as did the Internet Archive.

Is PHP2Shell Being Exploited Right Now?

As of October 22, the evidence is mixed. Amazon says its honeypots caught a first exploitation attempt on October 17, four days before the public release, and the security firms watchTowr and Patchstack have reported exploitation of their own. Cloudflare said it saw attack traffic aimed at its customers. On the other side, CISA said it had not observed exploitation when it published its alert, neither flaw appeared in its Known Exploited Vulnerabilities catalog, and Huntress saw nothing across its partner systems late on October 21. Amazon itself cautioned that it was unclear whether its early attempts would have worked against real servers, and analysts note that some public exploit scripts fail on certain versions.

The practical advice does not change. Public proof-of-concept code is circulating, and scans by VulnCheck, VirusTotal and Censys reportedly found more than one million internet-facing PHP servers still on unpatched releases on October 21. Waiting to see whether your site becomes a target is a poor bet.

Should Everyday Internet Users Worry?

Not about your phone or laptop. Malwarebytes points out that there is no PHP update to install on a personal device. The real exposure is the information websites hold about you. Voldemaras Kadys, head of security at Mediatech, told CBS News that if an online shop or booking platform is compromised, attackers could take details such as your name, email, address and date of birth. A site running PHP is not automatically breached, he added, and there is no reason to stop browsing or shopping, but extra caution with suspicious messages makes sense because nobody yet knows what data may have been taken.

A few habits help in the meantime. Use unique passwords, switch on two-factor authentication for accounts that matter, and be wary of unexpected emails or texts that mention a recent purchase. Nigerian tech outlet Technext24 also suggests avoiding saving primary debit card details on small merchant sites.

What Website Owners Should Do Now: How to Patch and Resolve the Issue

If you manage a site, treat this as urgent. The PHP project says no complete mitigations exist, so updating is the only safe choice. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

1. Find every PHP install. Count servers, containers, staging sites and any software or appliance that bundles PHP. CISA warns that PHP is often embedded in other products, so it may not be obvious.
2. Install the patched release or your vendor’s fixed package. Major Linux distributions including Debian, Red Hat and Ubuntu have published fixed packages.
3. Deal with old versions. PHP 8.1 and earlier get no upstream fix, though some hosting vendors backport patches. Upgrade, or get a vendor patch. CISA says systems that cannot be updated should come offline until they are.
4. Ask your host for proof. Confirm the fix is installed, not just scheduled. Automattic said sites on WordPress.com, WordPress VIP, WP Cloud and Pressable were already protected.
5. Check for signs of trouble starting October 17. Wiz suggests watching for unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses, unexpectedly large or malformed PHPSESSID cookies, and unexplained PHP worker churn. Because the memory-disclosure route can leave little trace, consider rotating passwords, API keys and tokens if you suspect exposure.
6. Treat a web application firewall as a stopgap. Cloudflare and others rolled out temporary protections, but they do not replace the update.

Longer term, general PHP hygiene limits the damage when something like this happens. CodeRabbit’s 2024 developer guide on common PHP issues, which predates PHP2Shell, recommends keeping credentials in environment variables or a secrets manager instead of in code, and tracking PHP releases so applications stay current.

What PHP2Shell Means for Nigeria and Africa

Local exposure is hard to measure. Profiled Nigeria says it found no published count of vulnerable Nigerian sites. What is clear is the type of software involved: Huntress, quoted by Reuters, noted that PHP quietly powers WordPress, Drupal, Joomla and Magento sites, shared hosting and control panels. That is close to the setup many small businesses, schools and bloggers across Lagos and beyond rely on.

Official guidance across the continent has varied. Technext24 reported that ngCERT, Nigeria’s computer emergency response team, posted a brief PHP2Shell alert on X on October 21 urging people to patch, while Ghana’s Cyber Security Authority and the National Information Technology Agency gave government agencies seven days to fix the flaws, and Kenya issued binding directives. If you run a site in Nigeria, confirm with your hosting provider that PHP has been patched, upgrade anything on PHP 8.1 or older, and report suspected breaches to ngCERT. Profiled Nigeria lists [email protected] for reports, so verify the address on ngCERT’s official channels before sending sensitive details.

What Happens Next

Three things are worth watching. The first is the long tail. Malwarebytes warns the risk may outlast this week because of forgotten infrastructure: abandoned websites, unsupported applications and connected devices with PHP-based admin pages. The second is the disclosure process itself. The PHP Foundation says the CVE identifiers leaked on October 20 and that Chainguard published patched images more than six hours before the coordinated release, which forced the schedule forward. Amazon’s security chief also said it was unclear how an attacker learned of the flaws while they were still under embargo.

The third is the AI race. Wiz argues that when complexity stops protecting old code, far more long-standing bugs become practical targets. For more on the security questions AI is raising, see our July editorial on OpenAI’s model hacking Hugging Face. The PHP Foundation, for its part, called its outlook cautiously optimistic, pointing to a fix delivered across all supported branches with advance copies for distributions and long-term-support vendors.

Frequently Asked Questions

Why PHP2Shell Matters Beyond This Week

The patch is the easy part. The PHP project shipped fixes across every supported branch, hosting providers moved quickly, and governments spoke with unusual urgency. The harder work is the unglamorous kind: finding the forgotten test site, retiring a PHP version nobody has touched in years, asking a host for proof instead of promises. If this week showed anything, it is that old code can carry fresh risk the moment the tools get good enough to find it. Check your own corner of the web today, and pass this along to whoever looks after the website you depend on.