South Africa presidency takes site offline over PHP2Shell

Governments and organizations around the world kept websites offline this week as a precaution against PHP2Shell. The name covers two critical flaws in PHP, the programming language that runs about 70% of websites. They were found with help from AI and patched on Wednesday, October 21. South Africa's presidency took its site down on Friday. Its spokesperson, Vincent Magwenya, said "such warnings do not indicate a security breach". Security experts warn the danger is not over, because many servers still run old versions of PHP and attackers are already trying to use the flaws.upi.com

How AI exposed the flaws

The bugs, tracked as CVE-2026-109618 and CVE-2026-109619, let attackers run code on a server without logging in. Both scored 9.2 out of 10 on the industry's severity scale, which places them in the critical tier. Researchers at the security firm Calif found one of the flaws in August using OpenAI's GPT-5.6 Sol model. The work was part of OpenAI's Patch the Planet program, and the firm Wiz found the flaws independently. OpenAI said it spent two months leading a group of maintainers and security companies to prepare the fixes. Details leaked early, so PHP's maintainers released the patch a day ahead of the planned October 22 date.en.sedaily.com+3

Sites go dark worldwide

In the UK, ministers confirmed on Thursday that 32 government services were temporarily offline and four more were partly unavailable. On Wednesday evening, at least seven of Scotland's 32 councils and six of its 14 health boards took their websites down, as did the Office for Budget Responsibility. Sites in France, Germany, the Netherlands and Finland also went offline.dig.watch+2

In South Korea, the presidential National Security Office held an emergency meeting on Thursday. The same day, the government raised its private-sector cyber alert from "interest" to "caution". Officials told organizations running PHP 8.1 or older, which no longer receives security patches, to upgrade.upi.com+1

Attacks keep growing

Amazon said it spotted an attempt to exploit PHP2Shell on October 17, four days before the flaws were made public. Matthew Prince, chief executive of Cloudflare, said attempts on its network went from thousands before the announcement to millions afterward.siliconangle.com+1

Adam Meyers of CrowdStrike said many outdated PHP versions are still in use and the patch probably did not fix every problem. "Malicious actors don't need to discover the vulnerability first—they can weaponize it afterward," he said. Jason Clinton, Anthropic's chief information security officer, warned that "as bad as things have gotten in the past four days, they are going to get a lot worse before they get better".cnn.com+1