PHP2Shell: AI-found PHP flaws leak, trigger global shutdowns
Researchers used frontier AI to find and weaponize flaws in PHP's core that allow unauthenticated takeover of servers running almost any PHP version of the last decade; PHP runs about 70% of websites. Details leaked before the coordinated patch, a probe hit Amazon's sensors four days early, Cloudflare logged millions of attempts, and governments from the Netherlands to Japan pulled public services offline as a precaution. No breach confirmed as of Oct 23.
Damage
Precautionary outages of national login systems, banks, airlines, payroll and government sites in a dozen-plus countries; millions of exploit attempts; no confirmed compromise yet
Inside the incident
How it happened
Two memory-safety flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619) let an attacker take over a server with crafted web requests — no login needed — and leave almost no trace beyond a memory error in a log. They sit beneath WordPress, Drupal and every other PHP app, so a secure app doesn't help. The bug IDs, a proof-of-concept video and other details leaked a day early; one vendor shipped fixed images hours before the agreed time.
The AI’s role
AI found it and made it exploitable. Calif first spotted the flaw with OpenAI's GPT-5.6 Sol; Wiz independently used Gemini 4 Argon and GPT-5.6 Sol to find the bugs and chain them into working attacks — work it says once would have taken a team months. After the leak, defenders built working exploits in under a day. There is no evidence yet that attackers used AI.
Damage so far
No organization has confirmed a breach, one vendor retracted its claim of one, and researchers who watched the first two days say reliable exploitation is harder than the leak implied. The damage so far is disruption: national login systems, banks, airlines, a payroll platform and government sites in more than a dozen countries went offline as a precaution; the UK alone confirms 32 digital services unavailable. The first malware is already riding on it: a Mirai botnet variant is trying to enlist exploited servers. Censys still counts 34.4 million vulnerable PHP services, and versions before 8.2 will never get an official fix.
Why it matters
It is the first time an AI-discovered bug pushed governments to switch off public services pre-emptively. The gap between a patch and a working exploit has shrunk to hours, and secrecy-based disclosure looks fragile when several labs' AIs can find the same bug. The counterintuitive lesson so far: the biggest AI-security event of the year has hurt nobody by hacking. It hurt by making everyone turn things off.
Every organization named, the map and the full timeline on the index →
Organizations affected
- Amazon Web Services (MadPot honeypot network)Cloud / tech, US, Attacked (blocked or unknown) · Honeypot sensors received a pre-disclosure probe on Oct 17 and repeated PoC-based attempts from Oct 21 ~02:00 UTC onward; honeypots, not…
- PantheonWeb hosting (WordPress/Drupal), US, Attacked (blocked or unknown) · Blocked more than 60,000 suspicious requests on its platform by the evening of Oct 21.
- Cloudflare (customer traffic)CDN / security, US, Attacked (blocked or unknown) · Saw early attacks against the flaws before disclosure, deployed WAF rules about nine hours early and kept updating them as attackers tried…
- VulnCheck canary networkSecurity research, US, Attacked (blocked or unknown) · Scanning across hundreds of canary hosts plus one failed attempt to plant a web shell.
- watchTowr Attacker Eye honeypotsSecurity research, UK/Singapore, Attacked (blocked or unknown) · Saw in-the-wild exploitation attempts against both CVEs; none succeeded at that point.
- ELLIO sensorsSecurity research, Czech Republic, Attacked (blocked or unknown) · Recorded its first related request at 08:36 UTC, under an hour after Chainguard's early images.
- Multiple Japanese servers (unnamed), detected by Trend MicroUnknown, Japan, Attacked (blocked or unknown) · Yomiuri reports Trend Micro detected attacks against multiple Japanese servers; damage unknown.
- Sophos customers (blocked attempts)Various, Various, Attacked (blocked or unknown) · Scanning and a small number of failed exploit attempts; Sophos blocked the follow-on payload from a Mirai-variant botnet.
Timeline
- Oct 23PHP flags a third, narrower code-execution risk (CVE-2026-115560) that needs an unusual session configuration. It recommends disabling session upload progress and will fix it in the next regular release; no exploitation reported.source
- Oct 23VulnCheck says it has an exploit that works against the recommended production configuration on x86-64, kept to its paying customers, and knows of no other public or commercial exploit that does so across PHP versions. Hunt.io, Wordfence and SOCRadar still report no confirmed compromise.source
- Oct 23Qualys, from about 12,000 customers, counts only about 199,000 PHP instances patched within 12 hours of disclosure; about 110 million (71%) run end-of-life versions that will mostly never get a fix.source
- Oct 23Neither flaw is yet on CISA's Known Exploited Vulnerabilities list, and no federal emergency directive has been issued.source
- Oct 23Censys counts 34.4 million PHP services still assessed as vulnerable across about 3.1 million hosts.source
- Oct 23Attackers try to use the flaws to recruit servers into a Mirai botnet variant (Potassium). Previdian, SOCRadar, Wordfence and Hunt.io still report no successful exploitation; VulnCheck shows a working chain against a default production build.source
- Oct 22The UK government confirms 32 digital services unavailable and four partially unavailable, mostly as a precaution; the NCSC has sent about 50,000 warnings.source
- Oct 22VulnCheck confirms a working exploit against default production settings of a widely used PHP 8.4 build.source
- Oct 22Sophos retracts its claim of one successful compromise; officials in Germany, the Netherlands, Japan and Australia report no confirmed breaches.source
- Oct 22Cloudflare's CEO says exploit attempts have reached the millions.source
Latest 10 of 38 events; the full timeline is on the index.
What officials said
What it means next
Coordinated disclosure embargoes are becoming fragile in the AI era: they protect defenders only until someone else independently finds the bug, and each early recipient adds leak risk. Experts call for shorter windows, fewer pre-notified parties, and treating patches themselves (including pre-built binaries) as sensitive.InfoWorld
Patch-to-exploit windows are collapsing to hours or minutes as AI cuts the cost of turning a patch diff into an exploit. Defenders should measure critical patch timelines in hours, automate response, and decide in advance who can take services offline.AWS
Disclosure dates no longer mark the earliest possible exploitation. Investigations should start from the earliest known activity (at least Oct 17) and assume possible compromise on exposed hosts, including rotating secrets that may have leaked from memory. Patching alone does not prove a system is clean.AWS
AI-found bugs in core open-source infrastructure will keep coming faster than under-resourced maintainers can fix them. The bottleneck has shifted from finding bugs to fixing them, raising triage burden and burnout risk, and the PHP Foundation is asking companies and governments for sustained security funding.OpenAI
End-of-life software is the long tail of risk. Roughly 42-79% of exposed PHP hosts run branches with no official fix, so expect lingering exposure, forced retirement of legacy sites, and slow downstream patching by distributors, appliance vendors, and OT/IoT makers.VulnCheck
Governments now treat precautionary mass takedowns as a legitimate response to AI-surfaced critical bugs. They are also formalizing frameworks for AI-discovered vulnerabilities, such as OpenAI's five-stage proposal, the EU Cyber Resilience Act reporting duty from Sept 11, 2026, and questions about who receives advance warning. Detection must rely on behavioral signals because these attacks leave almost no application-level trace.NSA
In their words
“This is an extremely urgent request that I ask everyone to act on tonight. … If it is difficult to apply the fix promptly, temporarily taking your website offline, for example, can be considered one effective measure to reduce the risk.”
“In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.”
“Servers running affected PHP versions are exploitable. Cyber actors are likely to weaponize PHP2Shell vulnerabilities. These risks are serious enough to require immediate patching across United States Government departments and agencies.”
Did they fix it?
- Reported Aug 11, 2026
Calif, working with OpenAI's GPT-5.6 Sol under OpenAI's 'Patch the Planet' program, reported the flaw to the PHP security team on Aug 11; Wiz independently found it with AI assistance (Aug 19) and reported it Aug 24. PHP acknowledged and… source
- Response Oct 21, 2026
The PHP Foundation moved the release up a day, shipped fixes on Oct 21 (~14:00 UTC), and publicly blamed the leak; it said Chainguard 'unilaterally broke the embargo' by publishing fixed images six hours early (Chainguard disputes this).… source
- Claimed fix Oct 23, 2026 partial
Fixed releases PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 address CVE-2026-109618 and CVE-2026-109619; branches before 8.2 get no official fix (Qualys counts about 110 million instances, 71%, on end-of-life versions; Censys still counts 34.4… source
- Independent check Oct 23, 2026 partial
No independent party has reported a way around the Oct 21 patch. VulnCheck says it has a working exploit against the recommended production configuration of unpatched hosts, kept to paying customers, and 'We are not aware of any other… source
- Where it stands Oct 23, 2026 ongoing
Day three after the patch: a Mirai variant is trying to recruit servers, a production-grade exploit exists but is held by one vendor, a third PHP bug is unpatched by design, most exposed hosts run versions that will never be fixed, and no… source
The capability behind it
- AI finds two critical flaws in PHP, the software under about 70% of websitesOct 21, 2026 · Wiz; Calif with OpenAI · reliable for a defined task: unknown
- OpenAI rates GPT-6 Astra 'Critical' for cyber, its first everSep 3, 2026 · OpenAI · reliable for a defined task: partial
- OpenAI's Daybreak puts cyber-tuned models in defenders' handsMay 12, 2026 · OpenAI · reliable for a defined task: partial
- Big Sleep finds a previously unknown SQLite flaw, a first for AI agentsNov 1, 2024 · Google Project Zero / Google DeepMind · reliable for a defined task: partial
Sources
Wiz Research, second source, third source. Live incident; will be re-scored if breaches are confirmed.
Factor ratings and the score are this index’s judgments by a published formula; facts, dates and figures come from the linked sources. Where a lawsuit is pending, the summary reports allegations, not findings.
