NEW YORK — Government agencies and major organizations across the globe took critical websites offline today, October 21, 2026, following the public disclosure of two severe vulnerabilities in PHP, a foundational programming language for a vast portion of the internet. The flaws, which remained undetected for over a decade until artificial intelligence helped bring them to light, prompted an emergency security release from PHP developers and urgent warnings from cybersecurity agencies worldwide.
The vulnerabilities, publicly identified as CVE-2026-109618 and CVE-2026-109619 and collectively dubbed PHP2Shell, are rated 9.2 on the CVSS 4.0 scale. Security experts confirmed these are unauthenticated remote-code-execution flaws, meaning an attacker could run malicious code on a vulnerable PHP server without needing any login credentials. The PHP Foundation, the nonprofit overseeing the language, issued a security release to patch these critical issues, with fixes made available on Wednesday, October 21, 2026.
The immediate and widespread response saw countries like Finland and the Netherlands proactively shutting down public-facing government websites. Finland's state IT center, Valtori, began pulling public-sector websites offline as a precautionary measure, stating that the outage was not due to an actual breach but that the risk was too high to keep sites running without the necessary fixes. Similarly, the Netherlands' National Cyber Security Centre temporarily took its own website offline and advised operators to either install the urgent updates or consider shutting down exposed systems.
The impact stretched across Europe. In France, local government websites, including one for the Paris police, became inaccessible at the request of the French National Cybersecurity Agency. Germany's digital ministry spokesperson confirmed that ITZBund had taken several federal websites offline as a preventive measure, though no security incidents had been reported. Belgium’s foreign ministry also temporarily took its websites offline, with the country's cybersecurity center noting no recorded attacks on Belgian sites. Denmark joined this list of nations, with its government also taking down at least some websites as a preventive measure. Canada's Minister of Artificial Intelligence and Digital Innovation, Evan Solomon, posted on X about the decision to temporarily go offline, highlighting the global reach of the issue.
Beyond national governments, numerous other organizations were affected. In the Netherlands, the national digital identity service DigiD, the website of the House of Representatives, and the site of the national cybersecurity center went dark as a precaution. The Port of Rotterdam, government site Overheid.nl, the national football association KNVB, websites of the five largest political parties, and numerous hospital websites also took their public-facing sites offline. The Wikimedia Foundation, which supports Wikipedia, stated that the flaws affected every PHP system it supports and had taken a number of them down until they could be safely patched. This included services like Toolforge and Cloud VPS, though for some Wikimedia services, users have direct control over the PHP version, making it more challenging for Foundation staff to safely restore them, potentially leading to longer outages.
The vulnerabilities’ discovery marks a significant moment, as they were reportedly identified with the assistance of artificial intelligence. Intelligence from companies like Alphabet and its subsidiary Wiz highlighted the role AI played in pinpointing these flaws. Researchers at Calif and Wiz, using OpenAI technology, identified the issues that reportedly remained undetected for more than a decade. Wiz specifically stated it used AI tools to discover the flaws, calling them the "most severe vulnerabilities ever discovered by AI." The company further elaborated that the flaws had remained undetected for so long because constructing a working exploit required a complex chain of steps at the edge of what human researchers could practically achieve, a barrier that "Frontier AI models eliminated."
The severity of the situation was underscored by industry experts. Tiffany Farriss, interim CEO of the Drupal Association, stated that "All servers using any version of PHP released in the last 20 years will be vulnerable" and that "This issue impacts the majority of the Internet." Volker Dusch, a security engineer at the nonprofit overseeing PHP, called it the worst security problem the project has confronted in more than 10 years, drawing comparisons to the infamous Heartbleed bug. The vulnerabilities affect PHP versions dating back to PHP 5.4, covering a vast installed base.
Cybersecurity agencies worldwide quickly issued warnings and recommendations. The US Cybersecurity & Infrastructure Security Agency (CISA) encouraged organizations to update to the new patch, as did authorities in the UK, European Union, Australia, and Japan, who advised organizations to identify affected systems and apply updates immediately. The UK's National Cyber Security Centre also raised alarms. The White House was made aware of the issue on Friday, October 18, 2026.
While patches were released today, the full technical details and affected versions of PHP were due alongside the emergency security release at 14:00 UTC. As of Wednesday, October 21, 2026, Valtori in Finland had not found any sign of actual exploitation, and the Dutch cybersecurity center said it had not seen the flaw abused but still urged everyone to patch. However, experts warned that hackers might exploit these flaws, potentially leading to mass intrusions. Costin Raiu, co-founder of cybersecurity research and incident response firm TLP:Black, said experts were bracing for a wave of intrusions as hackers jumped to get ahead of the updates, adding that AI was powering a "race to exploit," with the next step being the "mass compromise of every vulnerable web server on the internet." Lukasz Olejnik, a visiting senior research fellow at King's College London, cautioned that with AI, exploitation "may happen instantly, on a large scale."
Security breach risks remain high until updates are applied, and people who rarely update or maintain their deployed websites now face a higher risk of severe cyberattacks if they do not act swiftly. There are allegations that the vulnerabilities had been under embargo until Thursday, October 22, and some reports indicated that hackers were already exploiting the flaws to break into websites, though these claims remain unconfirmed by official sources. OpenAI claimed that "frontier AI" was key to discovering these PHP flaws, but the researcher who found them reportedly stated they used publicly available AI models. The published information did not confirm whether any of the affected Dutch websites had been breached or if data had been stolen from them. The US cybersecurity agency CISA did not respond to emails seeking comment. A significant concern among experts is that the same AI tools capable of pinpointing these issues could just as well be used to exploit them for malicious means.