This week, government portals, banking and transport services, hospital websites and parts of Wikipedia’s backend systems were taken offline or restricted worldwide. The outages were not the result of a single large-scale sophisticated cyberattack but stemmed from two serious vulnerabilities in the PHP server-side language, collectively referred to as PHP2Shell. Because PHP underpins many widely used web platforms, operators carried out precautionary shutdowns and mitigations.
Which vulnerabilities are these?
The two issues are tracked as CVE-2026-109618 and CVE-2026-109619, each assigned a 9.2 severity score on the 10-point CVSS scale. The flaws are memory-handling bugs: during certain request processing the PHP runtime can reference freed or invalid memory regions, enabling attackers to cause unpredictable behaviour. The most severe consequence is remote code execution—an attacker can run commands on the server without authentication, potentially accessing sensitive secrets such as access keys or session identifiers, enabling data theft or follow-on compromises.
Crucially, an affected PHP runtime can make otherwise well-written web applications vulnerable: the problem is in the language implementation, not necessarily in the website code.
How widespread is the exposure?
PHP is highly prevalent: an October survey found that 69.3 percent of server-side language-based websites use PHP. That does not mean every such site is automatically compromised, but it indicates the potential scope of affected services is large.
How were the bugs discovered?
Researchers at Wiz identified the problems in August with the help of AI tools and developed working exploit methods. Experts from Calif and OpenAI also participated in uncovering the flaws and coordinating the disclosure and patches. According to Wiz, exploiting these issues previously required very complex steps; AI models sped up code analysis and attack-method testing, making the danger visible sooner. This demonstrates both the helpful and the risky aspects of AI: the same tools that accelerate vulnerability discovery can also aid attackers.
Patches and rollout
PHP maintainers released fixes on October 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. However, updating large IT systems is not trivial: organisations must inventory affected servers, verify that the new PHP version is compatible with existing applications, and thoroughly test services. That process is especially sensitive for banking, healthcare and government systems, as a faulty update can itself cause outages.
Because of that, the Hungarian National Cyber Security Centre (Nemzeti Kiberbiztonsági Intézet) recommended that where immediate updates are not possible, affected systems be disconnected from external networks or temporarily suspended.
What happened in practice?
After public disclosure, detected attack attempts rose sharply. Cloudflare reported that in the ten hours before the announcement they saw several thousand attempts; within a few hours after disclosure, detection counts had reached into the millions. These figures represent observed attack attempts, not millions of successful intrusions.
Wikipedia shut down several developer and backend services, including Toolforge and Cloud VPS systems, while trying to maintain the main public encyclopedia pages. Updating those backend systems is complex in part because some services are maintained by volunteer developers.
Countries and organisations also took precautionary steps: Germany, the Netherlands, Finland and France limited some public services; in Japan banks, airlines and rail operators enacted protective measures. In Hungary, on October 22 the government reported temporary suspension of magyarorszag.hu and several other government sites; officials said they had detected no signs of a successful intrusion. In many cases services were intentionally made unavailable to prevent exploitation rather than because a breach had already occurred.
Mitigations and next steps
Cloudflare implemented traffic-filtering protections, but emphasised that such measures do not replace applying the official PHP updates. End-of-life or unsupported systems may require full-version upgrades rather than simple patching.
The most secure course of action remains to update affected PHP installations to the released patched versions as soon as possible, or where immediate patching is infeasible, to isolate the systems from external networks until they can be secured.
Summary
The PHP2Shell incident highlights how programming errors hidden for more than a decade can pose systemic risks to internet services. AI-assisted research accelerated discovery and exploit testing; official fixes appeared on October 21, but system operators continue to face complex compatibility, testing and rollout challenges to ensure services are safely updated.
