The websites that went dark in October 2026 were not knocked over by an AI. They were switched off by their own operators after an AI security vulnerability investigation exposed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), two critical flaws in the PHP engine that powers a large share of the web. When security agencies advised organisations to take systems offline if they could not patch quickly, government portals, councils and media sites did exactly that. This guide, current as of October 26, 2026, draws on the PHP project's advisory, the PHP Foundation, the US Cybersecurity and Infrastructure Security Agency (CISA) and the UK National Cyber Security Centre (NCSC). It covers what was found, why sites went down, what role AI really played, and what site owners and ordinary users should check.

What is the PHP2Shell AI security vulnerability?

PHP is a server-side language that builds web pages before they reach your browser. WordPress, Drupal, online stores, forums and hosting control panels commonly run on it. Because these bugs sit in the PHP engine itself, a carefully written website could still be exposed if the server underneath was not updated. The PHP security advisory says both flaws can allow unauthenticated remote code execution (RCE), meaning an attacker who never logs in could run commands on the server. Both are rated 9.2 under CVSS v4.0.

The PHP project considers every installation that serves web requests to be at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with mod_php the highest-risk setup. The PHP Foundation explains that the bugs live in memory management and error handling, code nearly every request touches, which is why they were both severe and hard to fix without breaking compatibility or performance.

How seriously to take the 70% figure

Many headlines repeated that roughly 70% of the internet was affected. The BBC attributes that estimate to Wiz and notes it could not verify it. The share of sites built on PHP is not the same as the share that is actually exploitable, which depends on version, server setup and what sits in front of PHP. Treat the number as a sign of reach, not a count of victims.

Why were websites taken down if a patch existed?

The plan was a coordinated disclosure: Linux distributions and long-term support vendors received patches early so everyone could update at once. That plan broke down two days before release, according to the PHP Foundation. The key moments, in UTC:

The outages followed official advice. The UK NCSC told organisations that could not update or apply temporary mitigations to consider taking systems offline until fully mitigated. CISA went further for anyone unable to update immediately or still on unsupported PHP 8.1 or earlier: take PHP-based systems offline until patched. The BBC reported that Finland's public government web services, the Dutch cyber security agency's site, Edinburgh council and some BBC pages went offline, and the Wikimedia Foundation took down a number of systems as a precaution.

Recovery took time because finding PHP is harder than updating it. CISA points out that PHP is often a component of other software and may not be directly visible. Old outsourced sites, forgotten test servers, appliance admin panels and container images all need checking. Many organisations judged that a few hours offline cost less than cleaning up a breach, and the BBC quoted Cloudflare's CTO saying early attacks were already emerging.

What AI vulnerability discovery changed, and what it did not

This is called an AI-found vulnerability because AI did the heavy lifting in proving the bugs were dangerous. The PHP Foundation says it scanned PHP with an Anthropic model earlier in the year and later added OpenAI tooling to validate reports and exploits. Wiz, quoted by the BBC, said frontier models let researchers develop and adapt working exploits across multiple applications in hours. A problem that stayed theoretical in 2024 was confirmed as an unconditional RCE within weeks in the summer of 2026.

• Changed: the speed of confirming that old, subtle bugs are exploitable.
• Changed: report volume. The PHP security team published 15 CVEs since July 1 and worked through more than 100 reports that were invalid, duplicates or not reproducible.
• Unchanged: choosing the fix. Weighing compatibility, performance and third-party extensions, then reviewing the patch, still fell to a small group of engineers.
• Unchanged: the human side of disclosure. A leak, a mistakenly published demo video and a broken embargo did more to compress the timeline than any model.

A fairer reading is that AI sped up both defenders and attackers. The PHP Foundation expects tools to keep finding bugs faster and report numbers to keep rising, so the winning skill is knowing your assets and patching quickly. If you want to follow how AI security stories spread, theddari's AI Telegram trends and blog trends dashboard show which topics are gaining attention. Those signals are context only; base any action on the PHP advisory and agency guidance.

页面引用

趋势theddari.com›趋势Telegram · AIAI 频道实时帖子

页面引用

趋势theddari.com›趋势博客仪表盘Naver 博客活跃度排行

Checklist for site owners

Combining the NCSC, CISA and PHP guidance gives a clear order of work. Do not assume a recent version is safe: the NCSC says all versions may be affected, so look for every PHP installation rather than only outdated ones.

1. 1

   Inventory every PHP install

   Start with internet-facing systems, then internal ones. Include agency-built sites, test servers, admin panels, appliances that bundle PHP and container images. The NCSC points to NCSC-NL's list of software with a PHP dependency.

2. 2

   Update and restart

   Move to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later, or your distribution's patched package. Restart every worker and confirm the new build is actually running. Plan a move off 8.1 and older.

3. 3

   Mitigate or go offline if you cannot patch

   PHP lists temporary settings, including memory_limit=-1 set so applications cannot override it, a lower post_max_size and session.upload_progress.enabled=0. They narrow specific paths only. If even these are not feasible, follow the NCSC advice and consider taking the system offline.

4. 4

   Hunt for compromise

   CISA advises watching for PHP worker processes launching shells or downloading tools. Look for new PHP files in web directories, unexplained outbound connections and bursts of out-of-memory or server errors. Preserve logs before rebooting a suspect server.

5. 5

   Keep watching for follow-ups

   On October 23, PHP issued an informational advisory recommending session.upload_progress.enabled=0 until the next regular release. Track updates from vendors whose products bundle PHP.

What everyday users should know

Most people never touch PHP directly; this is a server problem. If a site you use is briefly unavailable, it is most likely a precautionary check, so follow its official status page or social account. Be wary of emails or texts asking you to log in to confirm your security, because phishing usually spikes after big headlines. If you reuse a password across sites, change it, and turn on passkeys or two-factor authentication where offered.

Some risk remains. Small sites and devices on unsupported PHP may stay exposed for months. Exploitation attempts reportedly began before disclosure, and updating does not evict an attacker who already got in. And as AI makes exploit validation faster, disclosures of this scale may recur. The practical lesson for operators is to keep an up-to-date record of where PHP runs, which version is installed and when it was last patched, so the next advisory becomes a routine task rather than an emergency.