On 21 October the PHP project shipped emergency fixes for two flaws in the core of the language, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell. Both let an attacker run code on a web server without logging in and without anyone on the server doing anything. PHP's security team rated each 9.2 out of 10; some early reports said 10.1 PHP sits under WordPress, Drupal, Magento and Laravel, and runs about 70% of websites whose server-side language can be identified, according to W3Techs.2 The bugs had been in the code for more than a decade.3
How AI found them
The security firm Calif found one of the flaws in August, during an audit of PHP funded by OpenAI and carried out with help from an OpenAI model. Wiz, owned by Google, independently found and reported both.4 Wiz said exploiting them took a complex chain of steps "at the edge of what human researchers could practically achieve", and that researchers used AI to adapt the exploitation techniques.5
That is the new element. Old bugs in widely used software are not unusual. What changed is the cost of finding them, and of turning a finding into a working attack, in code that thousands of people had read for years.
The leak and the scramble
Disclosure was meant to be coordinated, with patches released at the same moment the flaws were made public. Instead the details leaked on 20 October, a day early, and the release was pulled forward.6 The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older branches get no upstream fix, and the PHP developers said no configuration change fully blocks the attacks: upgrading is the only complete defence.1
Officials told operators who could not patch at once to take their sites down. The NSA and Europe's cyber-security agency urged immediate action, and the FBI warned of remote code execution.4 Government sites in France, Denmark, Finland and the Netherlands went offline while fixes were applied, including the Dutch national cyber-security agency's own site. In Australia the government's cyber-security site went down, and in Japan ANA, JR West and the bank MUFG suspended some web pages and services.23
Attacks: attempts in the millions, compromises unconfirmed
- Before disclosure. Amazon's honeypot network recorded an exploit attempt on 17 October, four days before the flaws were public. Amazon said it was unclear how the attacker got the information, or whether such attempts would have worked on real systems.7
- After disclosure. Cloudflare saw tens of thousands of attempts within 45 minutes of the news breaking, and millions by early on 22 October. Some of the attempts tried to install a variant of the Mirai botnet.8
- Exposure. Palo Alto Networks identified more than 22.6 million exposed instances potentially vulnerable to the flaws. Other scans, counting hosts or services differently, put the figure at between 2 and 11 million.8
Germany's federal cyber-security agency, the BSI, rated the threat orange, its second-highest level, and advised operators who could not patch quickly to consider taking their servers offline. Attempts are not compromises: by 23 October no successful break-in had been publicly tied to PHP2Shell, and the BSI and Japan's government had confirmed none. Most of the outages were precautions taken while patching.9 With millions of unpatched servers and a working attack in circulation, that will not last.
A bad week elsewhere
Two confirmed compromises landed the same day, though neither has been tied to AI-found flaws. Version 1.107.0 of LiteLLM, a widely used open-source tool for connecting software to AI models, was published with a credential stealer and a backdoor after its release pipeline was compromised. PyPI quarantined it.10 The cloud platform Railway disclosed that an unauthorised party may have obtained some customers' decrypted environment variables, which typically hold passwords and API keys. It told customers to rotate their secrets and invalidated all Railway API tokens.11 Commentators have taken to calling the month "Black October".12
Why it matters beyond this week
PHP2Shell is the largest case so far of a pattern that has been building for a year:
- In November 2025 Anthropic reported a Chinese state-sponsored campaign that used its AI to carry out most of the tactical work of an espionage operation (see our frontier-risk report).
- In March 2026 Anthropic said one of its models had found 22 vulnerabilities in Firefox in two weeks, 14 of them rated high severity by Mozilla.13
- In May 2026 Google's threat intelligence group reported the first confirmed AI-built zero-day exploit, a two-factor-authentication bypass for a web administration tool, caught and patched before a planned mass-exploitation campaign.14
An Anthropic executive told Bloomberg this week that disruption of this kind would "get a lot worse before they get better".15
Does it pass the mechanism test?
A website outage is not an existential event. The pathway this site watches is narrower: AI that makes it cheap to find and exploit flaws in software that everything else depends on, faster than the world can patch. Taken far enough, that threatens the systems that run power, water, finance and government at the same moment. PHP2Shell does not show that this has happened. It shows the first stage at internet scale: the flaws were found with AI, the attacks began before disclosure, and the response depended on millions of operators patching within hours. We are treating it as a leading indicator, not a catastrophe.