AI-found PHP flaws push governments to take websites offline
Two critical flaws in PHP, the programming language behind a large share of the world's websites, were disclosed on 21 October 2026. The PHP Foundation shipped emergency patches the same day. Some government agencies and companies in several countries took websites offline while they applied the fix, and the FBI recommended that operators do the same if they could not update at once. The flaws were found with AI-assisted research. Some attackers reportedly tried to use them before the official announcement. For any business whose website, portal, invoicing tool or automated workflow runs on PHP, the practical answer is to confirm the PHP version on the server today, install the patched release, and check with the hosting provider that the update has been applied.
In short
- Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, were patched on 21 October 2026.
- The fix is a PHP update on the server, not a WordPress or plugin update.
- Patched PHP versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- Some attackers reportedly tried to exploit the flaws before the official announcement.
- Confirm your host has applied the update in writing, and do not rely on the vendor's word alone.
What happened
According to the PHP security advisory, the PHP Foundation released fixes for two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, on Wednesday 21 October 2026. Both are rated 9.2 on the CVSS v4.0 severity scale, which is the top tier for remote code execution. Security firms Wiz and Calif, together with OpenAI researchers, found the bugs using AI tools. The flaws are known collectively as PHP2Shell. The advisory was published in the afternoon UTC, after details had leaked ahead of the planned release.
According to Reuters reporting carried by Fortune, several governments chose to take sites offline as a precaution. Finland temporarily shut down public web services of its government, and agencies in the Netherlands removed their own sites. Japan's Chief Cabinet Secretary said the government had received no reports of damage, but that parts of some government websites had been taken down "just to be safe". In Ireland, the news site The Journal was offline for a time on Thursday morning while it strengthened its defences. Wikimedia also took several systems down, which left some readers unable to reach parts of Wikipedia.
Why it matters for businesses that automate work
The flaws sit in the PHP runtime, not in any one application. According to The Hacker News, a site can be exposed even when its own code is secure, and even a simple test page on a vulnerable version can be attacked. The risk is highest on servers that run PHP through Apache's mod_php module, where an attack can run before the application code starts.
This matters for automation because many automated workflows depend on PHP tools. Invoicing portals, order systems, customer forms, reporting dashboards and content sites often run on PHP. An automated process that sends data to such a system can fail when the system goes offline. A process that pulls data from an unpatched system can also expose that data.
Attackers also moved quickly. Amazon Web Services reported on 21 October that the flaw was being broadly exploited in the wild, and said it had seen attempts in the days before the 20 October disclosure. Cloudflare reported early exploit attempts as well, though The Hacker News said it had seen no confirmed breaches at the time of writing.
What changes in practice
For most businesses, the fix is a PHP update, not a WordPress or plugin update. According to Codeable, keeping WordPress current does not protect a site from this flaw, and WordPress.org said no WordPress update was required. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to The Hacker News and the PHP announcement.
Hosting providers did not move at the same speed. According to GoDaddy's update notice, its managed WordPress hosting was patched on 21 October, while its standard web and Windows hosting waited for patched packages from a vendor and used interim mitigations in the meantime. A business owner cannot assume the host has finished. The check is simple:
- Ask your developer or host which PHP version your site runs.
- Compare it with the fixed versions listed above.
- If the host has not confirmed the update in writing, ask for a date.
- Review access logs for unusual requests from 20 to 21 October, and keep them for your records.
- Record who signed off the update, so the next incident has a clear owner.
The Hacker News reported that no configuration change fully protects a server short of updating. Some workarounds circulated before the release, but the PHP team said only the update fully protects a server. Turning off a setting may block some attack paths, but not others.
Automation cannot do this check for you. A scheduled job can confirm the PHP version, report it to a dashboard or flag a site that is still behind. It cannot decide whether an outage is acceptable, sign off a change or judge whether a host's promise is enough. A person still makes those calls.
What to watch next
Three things will show how serious this becomes. The first is whether more hosts confirm patches on their platforms. The second is whether public exploit code spreads, since The Hacker News noted that attackers may reverse-engineer patches to find the flaw. The third is whether any government or company confirms a data breach. None had done so in the sources reviewed for this article.
Businesses that run older PHP branches should also expect a harder choice. Hosting providers have warned that older branches may not receive fixes, so an unsupported version may need an upgrade plan rather than a patch.
This article reports on a security advisory and public reporting. It is not a technical audit of any one system.
How AiStaffo would automate this
AiStaffo would start by listing every system your automated work touches, including invoicing portals, order forms and reporting dashboards, and recording the PHP version each one runs. An AI worker can then check those versions on a schedule, compare them with the fixed releases, and flag any system that is still behind. It can also log the host's confirmation and the date of each change. You still decide when a site goes offline, approve each update and confirm with your host that the work is done. The free audit shows which of your processes depend on PHP and how much would stop if one of them went down. Book a free automation audit.
Questions people ask
Do I need to take my website offline because of the PHP flaws?
Which PHP versions are fixed?
Is WordPress itself affected?
Has any data been stolen in these attacks?
Can automation handle the patching for me?
Book a free automation audit
Thirty minutes. We look at one process you run every week and tell you exactly what an AI worker would take off your desk, and what it would not.
