The quick read: • PHP released emergency fixes Wed Oct 21, 2026 for two flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. Both are rated 9.2. They can let an attacker with no login run code on a web server. • The flaws sit in the PHP engine itself, so a website's own code being clean does not protect it. Nearly every PHP version back to 5.4 is affected. Fixed versions: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. • PHP runs about 70% of websites worldwide, per the Associated Press. That includes nearly every WordPress site. • Who found them: Calif, using an OpenAI model in an OpenAI-funded audit, plus Wiz and OpenAI's own security team. OpenAI calls it "one of the most impactful security issues in recent memory." • The flaw's identifiers leaked Oct 20, so PHP moved its release up a day. • Japan, the Netherlands and Finland took some government services offline, and Britain said some limited services may be offline. The FBI told operators who cannot update right away to take websites offline. • Cloudflare's CEO said there were "millions" of attempts to exploit it in the hours after the announcement. No source has confirmed a successful break-in. • The root cause was first identified by a PHP developer in 2024 and left unfixed. The PHP Foundation calls that "a structural failure." • For a small business: updating WordPress does not fix this. The PHP underneath has to be updated by your host or whoever runs your server. Ask them today.
“A Flaw Found With OpenAI's AI Put PHP, the Software Behind About 70% of Websites, at Risk. Governments Pulled Their Own Sites Offline”
who’s making the noise
PHP security release, Wed Oct 21, 2026. Reported by the Associated Press (Oct 22), Business Insider (Oct 21), The Hacker News (Oct 21), Implicator.ai and Codeable (Oct 21).
our take
The headline says AI found a bug. The story is what happened next: governments switching off their own websites to stay safe, and millions of attack attempts within hours. Credit where it is due. The flaw appears to have been found before attackers found it, and the fix was out the same day the news broke. That is the good version of AI in security. The uncomfortable part is twofold. First, the root cause was spotted by a human developer in 2024 and deprioritized because nobody could show an exploit. It took an AI-assisted audit to prove the danger. Second, OpenAI itself says its newer models will find more of these. If the defenders have that speed, so will the attackers, and the patch race we saw this week becomes the normal week. The plain move for a small business: you probably run PHP without knowing it. If your site is on WordPress, updating WordPress is not the fix. Email your host and ask one question: have you updated PHP for CVE-2026-109618 and CVE-2026-109619, yes or no? If you run your own server and cannot upgrade, the government advice is to take the site offline until you can. What to watch: confirmed break-ins, whether the big shared hosts finish patching, and how many more flaws OpenAI's newer models surface.