For more than a decade, two serious flaws sat undetected in PHP, the programming language that quietly powers an estimated 70% of the world's websites. It took artificial intelligence to find them — and the discovery set off a global cyber-security scramble that is still rippling through government agencies, telecom carriers and household-name platforms more than a week later.
Cyber-security researchers at the firms Wiz and Calif disclosed the two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, on October 21. Both were rated 9.2 out of 10 for severity. "The most serious vulnerability I've ever found," Calif researcher Ryan Austin told the BBC. Under the right conditions, the firms said, the flaws could let hackers seize control of affected web servers and steal sensitive data from anything built on PHP — which includes Wikipedia, countless online shops and much of the WordPress ecosystem that underpins a huge share of the web.
What makes PHP so exposed
PHP — Hypertext Preprocessor — is the back-end language that turns raw data into the pages people read when they visit a website, and has powered dynamic web applications since the 1990s. It is maintained by the nonprofit PHP Foundation and underlies popular frameworks including Laravel, Symfony and Drupal. Paul Spain, chief executive of Gorilla Cyber Security, estimated the flaw could affect "millions and millions" of websites, while Jill Slay, a cyber-security researcher at the University of Adelaide, said it would be "disastrous" if hackers or hostile states weaponized it to seize private data at scale.
The fallout, country by country
The alert disrupted services from gaming platforms to government portals within days. Wikimedia took systems offline as a precaution; Finland's government, Edinburgh council, the Netherlands' cyber-security agency and some BBC pages also went dark temporarily. The UK government said 32 of its sites were taken down as a precaution, though it stressed none were large public-facing services. In France, telecoms operator Orange suspended access to some services globally while deploying fixes, and in Japan, SoftBank Corp temporarily suspended mobile emergency alerts for earthquakes and tsunamis — urging customers to find other ways to get warnings until the service resumes.
Microsoft chief executive Satya Nadella told a conference he had not seen anything like it "in a long, long time," adding it had been "a long day and a long night" for IT and security teams worldwide. IT administrators described near round-the-clock work patching systems. "It's been relentless," said UK-based system administrator Adam Mudd, who said he had never received so many anxious messages from clients. In Mauritius, administrator Loganaden Velvindron said many PHP installations were so out of date that his team was rebuilding entire web applications rather than simply patching them.
Panic outran the evidence
Despite the scramble, there have been no confirmed reports of successful large-scale exploitation of the flaw, known informally as php2shell. Cyber-security firms Cloudflare and AWS warned of millions of hacking attempts per hour, but several experts told the BBC that rumors of working exploit code circulating among criminal groups were overstated — one major security firm issued, then retracted, a warning that hackers had a working proof-of-concept. "We were flooded with rubbish intel about hackers being out there actively with working … methods," said UK cyber expert Daniel Card, who still called the underlying flaw serious. Mark Maunder, founder of the WordPress security tool Wordfence, said the episode was a preview of a new normal: "We're going to find scary vulnerabilities with the amazing capabilities that OpenAI and Anthropic are bringing online, but we need to calibrate the messaging."
The PHP Foundation released a software fix on October 21, and most major sites were back online within days, though smaller operators were still taking systems down for precautionary checks a week later. Experts expect AI-assisted vulnerability research to surface more flaws like this one with growing frequency — for better and worse.
