South Korea raises cyber alert as PHP2Shell attacks spread

Governments and companies around the world spent this week patching servers or taking websites offline after the disclosure of PHP2Shell. The name covers two critical flaws in PHP, the programming language behind about 70% of the world's websites, and both were found with AI tools. On Wednesday, Oct. 21, the PHP project released emergency fixes for CVE-2026-109618 and CVE-2026-109619. Both flaws let an attacker who has not logged in run code on a vulnerable server. The FBI and the NSA told organizations that cannot update right away to take their systems offline.edition.cnn.com+1

Exploitation began before the patch

Amazon said its decoy network recorded an exploit attempt on Oct. 17, four days before the flaws became public. The company now calls PHP2Shell "broadly exploited in the wild". "Once the embargo was lifted and the patch was released, additional proof-of-concept exploits appeared within hours," Amazon said. The flaw identifiers leaked on Oct. 20, so PHP's team moved its release up from Oct. 22.hwbusters.com+2

Government websites went down across Europe. In the UK, 32 government services were forced offline. On Thursday, South Korea's National Security Office held an emergency meeting with civilian, government and military officials. The country also raised its private-sector cyber threat alert from "interest" to "caution." Deputy director Song Ki-ho said the speed of the response would decide how much damage is done.upi.com+2

AI turned an old weakness into a crisis

Researchers at the security firm Calif found the flaws while working in OpenAI's Patch the Planet initiative. Wiz later found related exploits on its own. OpenAI called the bug "one of the most impactful vulnerabilities in recent memory". CNN reports that the underlying weakness was first flagged in 2004 but was too tedious for people to exploit, and AI worked out how to attack it in two days. Calif said it used only AI models that the public can already access.edition.cnn.com+1

Adam Meyers of CrowdStrike warned that many outdated PHP versions are still running. "Bad guys don't need to find the vulnerability first – they can weaponize it after the fact," he said.edition.cnn.com

Warnings of a "vulnerability tsunami"

Anthropic's deputy chief information security officer, Jason Clinton, warned on X that a "vulnerability tsunami" is coming. "As bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better," he wrote. He urged security leaders to ask their boards for help with "the basics," adding, "we need to hold on for ~18 months". Salesforce CEO Marc Benioff agreed. "Jason is 100% right. Code red," he posted on Thursday.businessinsider.com

Not everyone sees the same level of danger. On Wednesday, the PHP Foundation's executive director, Elizabeth Barron, told CNBC there was no "evidence of any working exploits." Researchers at Tolmo, however, said they built a working exploit in less than a day.cnbc.com