Quick answer: PHP released fixes on October 21 for two critical vulnerabilities that can allow unauthenticated attackers to run code on affected web servers. Some government and public-service operators took websites offline as a precaution while preparing or applying updates. Those shutdowns do not mean every affected site was breached.

The flaws sit in PHP itself—the server-side language used by WordPress, Drupal, Joomla and many other web platforms—not in a specific CMS plugin. PHP’s maintainers say the fixes are available and urge operators to update. The researchers’ shorthand for their combined exploit chain is “PHP2Shell.”

What are the PHP vulnerabilities?

The PHP team disclosed two critical issues, each rated 9.2 on the CVSS severity scale by CERT-EU. Both can lead to remote code execution without an attacker first logging in:

  • CVE-2026-109618: an out-of-memory handling flaw can leave PHP’s internal request data in an unsafe state.
  • CVE-2026-109619: stale internal state can persist after memory has been freed and be reused by a later request.

The official PHP advisory lists fixed releases: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. It says any PHP installation serving web requests may be at risk. The CERT-EU advisory gives the same fixed versions and rates both flaws 9.2.

For the main supported branches, update to the corresponding fixed release or to a patched package from your operating-system or hosting provider. PHP 8.1 and older no longer receive normal upstream security updates, although some vendors may provide backports and the PHP team published source backports for several older branches. Check with your provider rather than assuming a WordPress, Drupal or Joomla update also updates the PHP runtime.

Why did some government websites go offline?

Operators took some public-facing services offline as a precaution while fixes were being prepared or deployed. Reuters reported shutdowns or preventive maintenance in the Netherlands, Denmark, Finland and France. Examples included the Dutch National Cyber Security Centre’s site, the Port of Rotterdam, government portal Overheid.nl, the KNVB football association and hospital websites. Finland’s public web services and some Danish municipal services were also affected, while France’s Interior Ministry placed local-government administrative sites into preventive maintenance.

The important distinction is that a precautionary shutdown is not evidence of a successful intrusion. The BBC independently reported that some other pages, including Edinburgh Council and BBC programme sites, were inaccessible but had not confirmed a link to the PHP vulnerabilities. Cloudflare also told reporters it was seeing early attack activity, but public reporting has not established how many systems were compromised.

How did AI help uncover the flaws?

Security researchers used AI as part of a broader, human-led investigation. Wiz says its researchers used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol during discovery and exploit research. OpenAI says its partner Calif identified a critical flaw using GPT-5.6 Sol, while Wiz independently discovered and reported both vulnerabilities. PHP maintainers led the fixes, with companies and security teams coordinating testing and guidance before public disclosure.

That is a more precise description than saying an AI independently found and fixed the bugs. The case shows how AI tools can assist difficult security research, while the same faster analysis may also lower the effort required to adapt attacks. The PHP release and coordinated response created time for operators to update, but the window is not a reason to delay.

What should website owners and IT teams do now?

First, identify where PHP runs across your infrastructure, starting with internet-facing servers. Apply the fixed version or a vendor-provided backport, and check appliances and hosted services that may bundle PHP. If a hosting company manages the server, ask it whether the runtime is patched. A CMS’s automatic update feature may update the application without updating PHP itself.

The UK National Cyber Security Centre and CERT-EU advise organizations to patch affected systems immediately. If an internet-facing system cannot be updated or safely mitigated, CERT-EU says to consider isolating it from public networks until the fix is applied and verified. PHP says only the update fully fixes the vulnerabilities; temporary mitigations reduce some attack paths but do not make a system safe. If patching is delayed, review the official advisory and consider whether the system needs a compromise assessment.

How widespread is the exposure?

PHP is used by a large share of the web, but the often-repeated estimate that roughly 70% of the internet is affected should not be treated as a verified count. Wiz has published that estimate; the BBC said it could not independently verify it. The practical scope depends on which servers run PHP, their versions, deployment settings and whether a vendor has backported the fix.

For operators, the actionable point is narrower: PHP says web-serving installations need attention, and the fixed releases are available. Check your actual runtime with your hosting provider or administrator, apply the appropriate vendor update, and do not assume a site is protected just because its CMS has been updated.

iTMunch reviewed PHP’s official advisory, CERT-EU and UK NCSC guidance, plus reporting from Reuters and the BBC. AI-tool contributions are attributed to Wiz and OpenAI. This report does not claim that all offline sites were compromised or that the 70% estimate is independently verified.