NAIROBI, Kenya – Governments, hospitals and major online services across Europe temporarily took websites offline after two critical vulnerabilities in PHP, a programming language powering much of the internet, triggered an international cybersecurity scramble.
The emergency response followed the disclosure of flaws that could allow attackers to execute malicious code remotely on vulnerable servers, potentially exposing sensitive information and giving hackers access to systems running affected software.
PHP developers released security updates on Wednesday, October 21, urging users to install them immediately after technical details of the vulnerabilities began circulating before the planned disclosure date.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively dubbed “PHP2Shell”, received critical severity ratings of 9.2 out of 10 under the CVSS 4.0 system.
The incident has highlighted a growing cybersecurity dilemma: artificial intelligence is helping researchers uncover weaknesses that may have remained hidden for years, but the same technology can also help malicious actors develop ways to exploit them.
Governments Shut Down Websites to Prevent Cyberattacks
Several European countries took precautionary measures as cybersecurity teams worked to determine which systems were exposed.
In the Netherlands, the National Cyber Security Centre went offline temporarily, alongside other public-facing services, including the government portal Overheid.nl and websites belonging to several political parties.
The Port of Rotterdam, the national football association KNVB and some hospital websites were also among the services reported offline.
Finland’s state IT services provider, Valtori, took government public network services offline as a precaution, while France’s Interior Ministry placed its websites into preventive maintenance.
Denmark also reported disruptions after municipal IT company Kombit shut down several services, including a national school communication platform.
The temporary shutdowns were intended to reduce exposure while administrators assessed their systems and applied the available fixes.
The response illustrates the difficult choice facing organisations during a major software vulnerability: accept temporary service disruption or risk leaving systems accessible to potential attackers.
How AI Helped Uncover the PHP Vulnerabilities
The vulnerabilities were identified through AI-assisted security research, with multiple teams reporting discoveries involving the same underlying weaknesses.
Cybersecurity company Calif said it had identified the flaws with the assistance of a large language model and had worked towards a coordinated disclosure.
Google-owned cybersecurity firm Wiz also reported using its AI-based research tools and advanced models to help identify the vulnerabilities.
The PHP Foundation said AI-assisted code analysis had contributed to the discovery process, underscoring how automated tools can examine complex software for weaknesses that conventional testing might miss.
The vulnerabilities affected parts of PHP involved in memory management and request handling. Under certain conditions, a malicious request could trigger memory corruption or cause the software to use internal data after it had been freed.
Successful exploitation could allow an unauthenticated attacker to execute code on a vulnerable server, depending on its configuration and software environment.
The discovery does not mean AI created the vulnerabilities. Rather, it helped researchers identify weaknesses already present in the software.
Why One Programming Language Puts So Many Websites at Risk
PHP is a free, open-source, server-side programming language used to build and operate websites and online services.
It works behind the scenes, processing requests and generating the content delivered to visitors’ browsers. It also underpins popular website platforms and content management systems, including WordPress, Drupal and Joomla.
Web technology tracker W3Techs estimates that PHP is used by nearly 70 per cent of websites whose server-side programming language can be identified.
That widespread adoption means a vulnerability in PHP itself can affect organisations far beyond those that deliberately developed their own applications using the language.
According to Reuters, internet intelligence firm Censys identified approximately 1.5 million of 2.6 million hosts reporting versions of PHP for which no fix was available at the time of its assessment. The figure highlighted the scale of the potential exposure, although it did not establish that every host was successfully exploitable or had been compromised.
The risk also varies according to the PHP version, server configuration and whether an organisation has already applied a vendor-provided security update.
Hackers Were Testing the Flaws Before Public Disclosure
The timing of the disclosure has added to concerns among security researchers.
Amazon security chief CJ Moses said the company detected an attempted exploit against one of its decoy systems, known as a honeypot, on October 17, four days before the vulnerabilities were publicly disclosed.
The activity originated from an anonymous internet address. Amazon said it remained unclear how the actor obtained information about the vulnerabilities while technical details were still under embargo.
The company also reported detecting additional attempts before the disclosure period ended and warned that the flaws were being broadly exploited in the wild.
A honeypot is a deliberately exposed system designed to attract and monitor suspicious activity. An attempted attack against one can provide evidence that someone is testing a vulnerability, but it does not by itself establish that a real-world target was successfully compromised.
The early activity raised questions about how information concerning the flaws had circulated before the coordinated disclosure date.
Security Updates Released, but Older Systems Remain a Challenge
PHP developers released patched versions for supported branches, including PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Security agencies advised organisations to identify every PHP installation, prioritise internet-facing servers and apply the relevant update as soon as possible.
Systems running older, unsupported versions present an additional challenge because they may not receive official updates through the normal PHP release process. Some software distributors and hosting providers may supply backported fixes, but administrators must verify that those updates address both vulnerabilities.
Where immediate patching is not possible, security agencies have advised organisations to consider taking vulnerable public-facing services offline until the risk can be addressed.
Patching also does not automatically eliminate evidence of an earlier intrusion. Organisations that were exposed before applying a fix may need to examine server logs, investigate suspicious activity and check whether attackers gained access.
AI Creates a New Race Between Security Teams and Hackers
The PHP incident demonstrates the dual role artificial intelligence is beginning to play in cybersecurity.
Researchers can use AI to examine large codebases, identify unusual behaviour and uncover weaknesses more quickly. Attackers can also use AI to understand publicly disclosed flaws and accelerate the development of exploits.
Once a vulnerability becomes public and working technical demonstrations circulate, organisations that have not updated their systems face greater pressure to act quickly.
For smaller organisations and website operators with limited technical resources, the challenge may be finding every affected server, determining which version is running and applying the correct patch before an attacker gets there.
The immediate priority is therefore not simply keeping websites online, but ensuring that the software supporting them is secure.
The emergency response to PHP2Shell has shown how a weakness buried in widely used infrastructure can become a global problem within hours—and how AI can accelerate both the discovery of vulnerabilities and the race to exploit or fix them.
