Governments race to patch critical PHP vulnerabilities affecting 70% of websites
On October 21, 2026, critical vulnerabilities in PHP—a programming language powering an estimated 70 percent of websites globally—were discovered using artificial intelligence tools. The two flaws, collectively called PHP2Shell, can allow attackers to remotely execute code on affected servers, potentially exposing sensitive data and databases. Major government websites in Europe, Australia, and elsewhere went offline Wednesday and Thursday as a precaution while security teams rushed to apply emergency patches. Cybersecurity agencies including the U.S. National Security Agency, FBI, and UK National Cyber Security Centre urged organizations to update immediately or take systems offline until fixes could be deployed. The vulnerabilities had been lurking for years and affected PHP versions from 5.4 to 8.5. While no massive attacks had been confirmed at time of publication, security firms observed early exploitation attempts within hours of disclosure, and experts warned the race between patching and hacking had intensified in the artificial intelligence era.
Key facts
- Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) discovered October 20-21, 2026 using AI tools
- PHP powers approximately 70% of all websites globally
- Affects PHP versions 5.4 through 8.5
- Vulnerability severity rated 9.2 out of 10 on CVSS scale
- 32 UK government services went offline, 4 partially unavailable
- Government websites in Netherlands, Finland, France, Belgium and other nations taken offline as precaution
- Patches released October 21, 2026 for versions 8.2, 8.3, 8.4, and 8.5
- Security researchers observed exploitation attempts within hours of public disclosure
How different outlets framed it
Left-leaning coverage: Left-leaning outlets emphasize the urgency and systemic vulnerability, highlighting that AI-powered tools can now find and exploit security flaws at scale much faster than traditional methods. They focus on the coordinated international response and how this exemplifies the need for stronger investment in cybersecurity infrastructure and workforce training as a public good.
Right-leaning coverage: Right-leaning coverage emphasizes government and Trump administration coordination to protect American networks and critical infrastructure, stressing how the federal government is taking action to address the threat. Some conservative outlets frame this as an example of why reliance on open-source and third-party software creates national security risks that require stronger government oversight.
Limits of this briefing
Full scope of attacks in the wild remains unclear as of publication; most major outlets agree no comprehensive breach confirmation exists yet. Coverage may evolve as incidents are discovered and patched systems are restored.
Sources
- Reuters: Government Websites Go Dark After AI-Discovered Flaw Sparks Security Scramble Centre
- BBC: 'It's been relentless': IT workers scramble to fix PHP flaw described as worst crisis in years Centre
- Cybersecurity Dive: Critical PHP vulnerabilities expose most websites to potential compromise Centre
- Fortune: AI tools discovered the PHP vulnerability that could take down 70% of the internet. Now the race is on to patch it before AI-powered hackers attack Centre
- The Epoch Times: US Cybersecurity Agencies Urge Immediate Fix for Bug Threatening Millions of Websites Right