Websites around the world went dark after a serious vulnerability was found in PHP, the programming language used to build much of the web, The Guardian reported. Belgian, Dutch, Finnish, French and German sites were among those governments took down temporarily as they scrambled to patch the critical weakness in a language used by almost 70% of websites. The flaw became public on Tuesday, prompting warnings from national security agencies in Washington and London and leaving millions of websites in need of repair.
The takedowns were precautionary rather than evidence of successful mass compromise, but the scale of the response reflects how deeply PHP is embedded in public infrastructure. The Guardian reported that the Wikimedia Foundation took down several systems on Wednesday until they could be patched, and that council websites in Edinburgh, Bristol and Oxford were taken offline. In France, local government sites including that of the Paris police prefecture went offline, while in the Netherlands the national digital identity service, the website of the house of representatives and the site of the national cybersecurity centre were affected. The Australian Signals Directorate was temporarily affected overnight local time.
What the flaw actually is
The Register reported that the two bugs, collectively called PHP2shell and tracked as CVE-2026-109618 and CVE-2026-109619, can allow an unauthenticated attacker to execute code on servers running PHP. Both are memory corruption vulnerabilities tied to how PHP handles memory management and error handling. One leads to remote code execution via out-of-memory corruption; the other allows it through stale state left behind after a fatal error. According to The Register, the project maintainer noted that on Apache with mod_php an unauthenticated request can trigger the first bug before any application code runs. The BBC reported that the European Union Computer Emergency Response Team said the risk scores indicate the potential for unauthenticated remote code execution, and that it is not yet clear which versions are affected, though CERT-EU said the flaw could affect all versions dating back to PHP 5, launched in 2004. The PHP Foundation issued the update only for the latest versions, with users of PHP 8.1 or older urged to upgrade.The disclosure fight
A second story has emerged alongside the technical one. PHP maintainers published a blog accusing software supply chain security firm Chainguard of breaking a coordinated disclosure embargo. According to The Register, the PHP Foundation said that on 21 October at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally published built images containing the fix, allowing any attacker to study the fix in binary form while other PHP users waited. Chainguard chief executive Dan Lorenc told The Register he does not dispute the timeline but said his company "didn't leak". He said Chainguard learned something was coming in PHP on the Friday from one of the researchers, then independently found the same memory corruption vulnerabilities using its own AI harness and a frontier model. He said the decision to ship fixes followed evidence of active exploitation in the wild, telling The Register: "It's coordinated vulnerability disclosure, unless there's evidence of active exploits in the wild." Asked whether he would do anything differently, he said no. The Register reported that the trouble began on Tuesday around 15:00 UTC when two CVE IDs began circulating on online forums and social media along with incorrect information about release time and severity rating. The BBC reported that the PHP Foundation had intended to release its discovery later in the month with a complete fix, but details leaked on social media on Tuesday, forcing it to rush out its announcement.Who found it, and how
The discovery is bound up with AI. The BBC reported that the vulnerabilities were found by researchers at Calif and Wiz, and that Calif and the PHP Foundation were part of a programme started by OpenAI called Patch the Planet, through which they were given access to advanced AI tools. OpenAI said in a blog post that the discovery was "one of the most impactful security issues in recent memory". Wiz said the flaws were the "most severe vulnerabilities ever discovered" by the technology. The Guardian reported a point of friction in that narrative: OpenAI said it led a coalition of researchers and claimed frontier AI had been key, but the researcher who found the weakness said they used models available to the public. The Guardian also reported that Wiz said the vulnerabilities remained hidden in the PHP codebase for more than a decade and would have been extraordinarily complicated for a human hacker to exploit.The exploitation race
Because a fix is now public and AI tools can reverse engineer the bug with little effort, experts told The Guardian they were bracing for a wave of intrusions. Costin Raiu, co-founder of TLP:Black, described a "race to exploit" and said the next step was the "mass compromise of every vulnerable web server on the internet". Prof Alan Woodward of Surrey University told The Guardian the troubling part was the long tail of poorly maintained websites that would remain vulnerable, meaning "we may see weeks and months of ongoing attacks". The Register reported that Chainguard's honeypots trapped IPs from China and Russia targeting the vulnerabilities on Wednesday. The Guardian reported that Amazon security chief CJ Moses said its team detected an attempt to exploit the vulnerabilities against a decoy honeypot system on 17 October, four days before public disclosure, from an anonymous internet address, with it unclear how the actor learned of the flaws while under embargo. Cloudflare chief technology officer Dane Knecht said he was seeing early attacks emerging, according to the BBC.Commercial Impact
The immediate commercial burden falls on organisations that run PHP without knowing it. Don Smith of the Sophos Counter Threat Unit told the BBC the immediate challenge was not simply installing a patch but finding and managing every instance where PHP is running, noting it can sit beneath public websites, content management systems, hosting platforms and third-party products, sometimes without being obvious to the organisation using it. That is a discovery and inventory problem as much as a patching one, and it lands on shared hosting providers, agencies and IT teams that inherited estates they did not build. The reputational dimension is equally commercial. Chainguard's business is built on securing software supply chains, and being publicly named by PHP maintainers as the party that broke an embargo is an awkward position for a company selling trust in exactly that process. Lorenc's defence, as reported by The Register, is that active exploitation changed the calculus. Whether customers accept that framing is a commercial question, not a technical one.Risks and Unknowns
The scope of exploitation remains unclear. The Register reported that it is still unknown what will happen to vulnerable legacy systems that do not have security fixes. The BBC noted it could not verify Wiz's estimate that roughly 70% of the internet is affected. The Guardian reported that the White House said it was made aware of the flaw on Friday, and the BBC reported that federal agencies were working with leading AI labs to speed up a fix. Japan's Prime Minister Sanae Takaichi urged people to check whether their public websites ran on PHP. There is also an unresolved question about how the embargo broke. The PHP Foundation's blog points at Chainguard, but The Register reported that Calif mistakenly published a video showing a proof-of-concept exploit, and that mitigation advice given to critical infrastructure providers may have leaked. The public blame may be narrower than the full chain of events.Sources and References
- The Guardian (theguardian.com)
- BBC News (bbc.co.uk)
- The Register (theregister.com)
