Governments pull websites offline over PHP2Shell flaws

Government, school and hospital websites across Europe, Canada and the UK went offline on Wednesday, October 21. Organizations were rushing to install fixes for two critical flaws in PHP, the programming language behind a large share of the web. The European Union's cybersecurity response team, CERT-EU, had advised operators who could not patch in time to take their sites down, Reuters reported.reuters.com

The flaws are known together as PHP2Shell and are tracked as CVE-2026-109618 and CVE-2026-109619. They could let attackers run code on web servers without logging in. PHP released fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 and urged all users to update immediately, Help Net Security reported.helpnetsecurity.com

Shutdowns across three regions

Germany's federal IT provider, France's prefecture websites, Belgium's foreign ministry and Finland's government web services all went offline as a precaution. In the Netherlands, the Port of Rotterdam, Overheid.nl and many hospital sites did the same, according to Reuters. The Wikimedia Foundation also took some systems down. In Canada, Artificial Intelligence Minister Evan Solomon said some federal sites had been taken offline temporarily. Provincial sites in Newfoundland and Labrador and Prince Edward Island were also down, CBC News reported. At one point on Wednesday evening, at least seven of Scotland's 32 councils and six of its 14 health boards had pulled their websites, the BBC reported.cbc.ca+2

Cloudflare ↗ 6.29% said early attacks were emerging. Australia's cyber agency said it was not aware of active exploitation, Reuters reported. Palo Alto Networks ↗ 6.11% said it had found more than 22.6 million exposed instances that could be vulnerable, TechTarget reported.reuters.com+1

A leak forced an early release

The PHP Foundation had planned to disclose the flaws later alongside a patch. Details leaked on social media on Tuesday, October 20, so it moved the release forward, the BBC reported. The patch had originally been due on Thursday, October 22, The Detroit News reported.bbc.com+1

AI's role in finding the flaws

OpenAI said it spent the past two months leading a coalition of maintainers, researchers and security providers to address the problem. It said the security firm Calif found a critical flaw using its GPT-5.6 Sol model as part of its Patch the Planet initiative, and that Wiz independently discovered and reported both flaws, according to OpenAI's blog post. Wiz is owned by Alphabet ↘ 0.10%. It said the vulnerable code had been present for more than a decade, CBC reported. PHP's maintainers led the fixes and release, OpenAI said.openai.com+1

Wiz researchers said the flaws "rank among the most severe vulnerabilities discovered in PHP." They added that frontier AI models "substantially reduced" the barrier to turning a long-standing flaw into a working exploit, according to Help Net Security.helpnetsecurity.com

OpenAI described the discovery as "one of the most impactful security issues in recent memory," dpa reported. The company acknowledged that AI can also help attackers. "To our knowledge, frontier AI found these vulnerabilities before attackers did, opening a defender's window for maintainers and security providers to prepare fixes," it said.dpa-international.com