Less than 48 hours after the PHP Foundation disclosed two critical remote-code-execution flaws in the language that powers an estimated 70 percent of the web, the vulnerabilities are under active mass exploitation. Cloudflare says hacking attempts surged into the millions within hours of the disclosure, and governments and companies from Tokyo to Helsinki are shutting down services as an emergency measure while they patch.
The flaws, CVE-2026-109618 and CVE-2026-109619 and rated 9.2 under CVSS, were uncovered with the help of AI models — Calif found them with OpenAI’s models, Google’s Wiz with its own research. That same AI assistance is now the attackers’ weapon: as Aikido Security co-founder Madeline Lawrence put it, “Companies are racing to update against attackers who can use AI to exploit them. That’s the whole race.”
The Exploit Wave, By The Numbers
Cloudflare CEO Matthew Prince posted the attack timeline late Wednesday on X. In the 10 hours before the vulnerabilities were publicly announced, Cloudflare’s network saw thousands of exploitation attempts. That jumped to tens of thousands within 45 minutes of the announcement, hundreds of thousands within two hours, and millions now.
Amazon Threat Intelligence, another cybersecurity heavyweight, says PHP2Shell is “now being broadly exploited in the wild” — and it detected probing as early as October 17, four days before disclosure, through its MadPot monitoring network. Administrators are being told to review server logs back to at least that date, not just to the disclosure day.
The US National Security Agency warned the flaws could let attackers seize control of web servers, steal sensitive data and disrupt services, advising sites that could not patch immediately to go offline. Ciaran Martin, the former chief executive of the UK’s National Cyber Security Centre, called it “the most serious vulnerability discovered for five years.”
Shutdowns From Tokyo To Helsinki
Japan has seen the most dramatic response. Brokerage Nomura, lender Mitsubishi UFJ, airline ANA and East Japan Railway all temporarily suspended some internet services on Thursday; brewer Asahi and insurer Tokio Marine took websites down; and the Ministry of Finance, the Meteorological Agency and the National Tax Agency partially suspended online services. The prime minister told businesses to patch or shut their sites down.
In Europe, French telecoms group Orange suspended access to certain PHP-based websites across subsidiaries as a precaution, and government websites in several countries went offline to install patches. In India, banks began auditing applications and taking non-critical services offline while the government started emergency patching of official websites. Payments firm Razorpay said it has built an AI-led security posture that discovers and patches flaws at machine speed, warning merchants that AI models “can identify and attack security vulnerabilities that traditional human-based detection systems aren’t prepared to handle,” in the words of CEO Harshil Mathur.
A Leak Before The Patch?
The timeline is raising uncomfortable questions. The PHP Foundation released fixes on Wednesday — versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 — but Cloudflare and Amazon both observed exploitation attempts before the public disclosure. Security researcher Alan Woodward said the flaw was revealed a day before the patch was released: “somebody let the cat out of the bag.”
Not everyone sees catastrophe yet. Ryan Austin, a Calif researcher who helped discover the flaws, said that at the moment exploitation “doesn’t look like it has taken off or been widespread,” and the British Chambers of Commerce said firms had reported no significant difficulties. The gap between millions of observed attempts and confirmed compromises is real — the number of successfully breached sites remains unknown, and attempted attacks are not the same as successful ones.
Why It Matters
PHP2Shell is a stress test of the internet’s oldest infrastructure, and it is arriving as AI flattens the skill barrier on both sides. The same class of models that helped researchers chain together an exceptionally complex exploit — Wiz says the flaws had lurked in PHP for decades — now lets attackers probe millions of servers with minimal human effort. Patching windows that used to be measured in weeks are now measured in hours.
For enterprises, the week is a reminder that supply-chain security now includes the programming language itself — the LiteLLM supply-chain compromise earlier this week showed how one tainted library can reach thousands of developers, and PHP2Shell shows the blast radius when the foundation itself cracks. Tools like continuous code scanning are becoming baseline rather than luxury.
Background
PHP2Shell refers to two critical remote-code-execution vulnerabilities in PHP, the server-side scripting language first released in 1995 that still underpins the majority of the world’s websites, from WordPress blogs to banking portals. The flaws were found by security researchers working with frontier AI models — Calif with OpenAI’s models in July, and Google’s Wiz with its own AI-assisted research in August — and the PHP Foundation disclosed them on October 20 with fixes for all supported branches. The NSA, the FBI and authorities in several other countries have since issued urgent warnings, and the incident is being compared to Log4Shell, the 2021 Java library flaw that triggered a similar global patching emergency.
Source: Dawn ; The Economic Times
0 Comments