Palo Alto confirms PHP2Shell flaws affect PAN-OS

Governments, banks and companies around the world took websites offline last week after two critical flaws in PHP were revealed. PHP is the programming language that runs about 70% of the world's websites, according to Wiz Research. The bugs are tracked as CVE-2026-109618 and CVE-2026-109619 and together are called PHP2Shell. They let attackers run code on a server without logging in. The PHP project rushed out fixes on October 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, Amazon Web Services Amazon.com, Inc. ↗ 1.61% said. Details had leaked online on Tuesday, October 20, a day before the planned release.aws.amazon.com+1

Sites go dark worldwide

The US National Security Agency told organizations that could not update right away to "take the system offline until it can be fully mitigated," DW reported. NBC News Comcast Corporation ↘ 0.95% said this was the first time a US intelligence agency had used social media to advise website owners to go offline. CISA urged organizations to patch immediately.nbcnews.com+2

Finland temporarily shut down its government's public web services, and the Dutch cybersecurity agency took its own site offline, the BBC reported. In France, prefecture websites, including the Paris police site, were taken down, as were the Netherlands' DigiD identity service and its parliament's website, according to eNCA. In Japan, ANA, JR West and MUFG suspended some services, CNN said. Bangladesh Bank's website stayed down for days, and thousands of government and banking sites in Nepal went offline. Fixes are still arriving for some products. On October 24, Palo Alto Networks ↗ 2.88% confirmed that PAN-OS is affected and said hotfixes would ship from October 26.bbc.com+5

Millions of attack attempts

Cloudflare ↘ 1.22% CEO Matthew Prince said the company saw thousands of exploitation attempts in the 10 hours before the announcement. That rose to "tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now," SecurityWeek reported. Amazon said the first exploitation attempt hit on October 17, while the flaws were still under embargo, though organizations described the attempts they saw as unsuccessful.securityweek.com

AI on both sides

Calif found the flaws in August with OpenAI's GPT-5.6 Sol model, during an audit of PHP that OpenAI paid for. Wiz, which is owned by Google, says it found them on its own weeks later using Gemini 4 Argon and GPT-5.6 Sol, AFP reported. Alphabet ↗ 0.84% owns Google. Wiz called the bugs among "the most severe vulnerabilities discovered in PHP, and arguably in software history."afp.com

NBC News wrote that AI is helping both defenders and hackers find major flaws "at a dizzying pace." Steve Kerrison of James Cook University warned that some site owners "will have no idea about this and still won't for days, weeks and months," according to AFP.nbcnews.com+1