TLDR
- Two critical PHP flaws, known as “PHP2Shell,” could let hackers run malicious code on servers from afar.
- The NSA, FBI and authorities in several other countries have issued urgent warnings.
- Amazon spotted attempts to exploit the flaws before they were public, but it is unclear how attackers learned of them.
- Google and OpenAI said AI tools helped find the flaws, and Cloudflare deployed protections.
- Cloudflare reported millions of exploit attempts after disclosure, and some Japanese services were suspended.
Two critical security flaws in PHP, a programming language used to run much of the web, have set off warnings from governments around the world. Tech firms including Google, OpenAI and Amazon are working to protect affected systems.
Call me paranoid, but be extra careful visiting ANY web site in the next few days, as some web admins are not always up-to-date with security patches.
Two vulnerabilities (CVE-2026-109618 and CVE-2026-109619) reported for PHP, the web programming language, affecting servers…
— CZ 🔶 BNB (@cz_binance) October 21, 2026
The flaws are known together as “PHP2Shell.” Researchers say they could let hackers run malicious code on servers from afar.
Not every website that uses PHP is necessarily at risk. Still, the software’s wide use has raised concern about the possible scale of attacks.
Governments Issue Urgent Warnings
The U.S. National Security Agency on Wednesday urged organizations that use PHP to prepare security updates. It warned the flaws could give attackers direct access to file systems and databases.
The agency said affected systems should be taken offline if updates cannot be applied right away.
The FBI also warned that bad actors could use the flaws to run code remotely. Sensitive data and networks could be put at risk.
Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially… pic.twitter.com/tnwiQv5v0F
— FBI Cyber Division (@FBICyberDiv) October 21, 2026
Cybersecurity authorities in Singapore, the United Kingdom, Australia, Canada and the European Union issued similar alerts.
Japanese Prime Minister Sanae Takaichi urged website owners to check whether their sites use PHP. She asked them to prepare to apply the new fix.
Tech Companies Respond
Amazon said its MadPot threat detection system spotted attempts to exploit the flaws before they were made public. The company said it is unclear how attackers learned about them.
*FINLAND SHUTS STATE INTERNET SERVICES OVER PHP FLAWS
*NETHERLANDS CYBERSECURITY AGENCY TAKES WEBSITE OFFLINE OVER PHP FLAWS
*FRANCE TEMPORARILY TAKES PREFECTURE WEBSITES OFFLINE PENDING PHP FIX: MINISTRY https://t.co/mi9GbPXmOK
— *Walter Bloomberg (@DeItaone) October 21, 2026
Google said its cybersecurity unit Wiz used AI models to help find and study the flaws. Its Gemini AI also helped assess the flaws, test possible attacks and check security patches.
OpenAI said researchers using its AI models helped uncover critical flaws in PHP. The company said it spent two months leading a group of software maintainers and security researchers to coordinate fixes.
OpenAI described the flaws as a major security issue in recent memory.
Cloudflare said it deployed protections through its web application firewall. The company said the measures are meant to block harmful requests while organizations install updates.
The PHP development team released urgent fixes on Wednesday. The flaws had been hidden in the software for years until they were found using AI, and the team said all users were encouraged to update immediately.
Cloudflare CEO Matthew Prince said on X that the company saw thousands of exploit attempts in the 10 hours before the announcement. That rose to tens of thousands within 45 minutes after it, hundreds of thousands within two hours, and millions now.
Government websites in Europe and elsewhere went offline on Wednesday. Mitsubishi UFJ Financial Group said it was temporarily suspending some internet services because of emergency measures.
Japan’s Finance Ministry also paused some website content and services while security measures were put in place.
Stop guessing and start investing with confidence. KnockoutStocks gives you the AI insights, market intelligence, and stock research you need to spot opportunities, cut through the noise, and make smarter investment decisions — all in one powerful platform.
Sign up today and get 50% OFF full access to our premium stock picks.
Simply use coupon code SPECIAL50 at checkout to claim your exclusive discount.
