PHP2Shell: AI Surfaced a Decade-Old Flaw, and Governments Took Their Sites Offline

Two critical PHP vulnerabilities — found with AI-assisted research — just made governments voluntarily switch off their own websites. The flaw sat in the floorboards of the internet for over a decade. Working exploits took about a week. Within hours of disclosure, attackers were already using AI to mutate their payloads.

What happened

• Governments went dark on purpose. The Dutch National Cyber Security Centre's own website, the Port of Rotterdam's site, Overheid.nl, Finnish and Danish public services, French prefecture sites — and nearly three dozen UK government services, including the Office for Budget Responsibility and NHS Scotland — all went temporarily offline as a precaution. No large-scale exploitation is confirmed, but the shutdowns were real.
• The flaw is CVE-2026-109618 / CVE-2026-109619, rated 9.2/10. Remote code execution on a server, no login needed. The second flaw can leak process memory — the kind that holds passwords. Affected versions go all the way back to PHP 5.4 (2012), and PHP powers roughly 70% of websites whose server language is known: WordPress, Drupal, Joomla, Magento.
• AI compressed discovery — but humans led it. The PHP Foundation had a theoretical flaw since 2024 and couldn't work out the exploit. Then Calif's researchers reported one flaw using OpenAI's GPT-5.6 Sol, and Wiz (Alphabet-owned) reported the other using Google's Gemini 4 Argon plus its own Atlas tooling. Wiz: "With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work."
• The attack side got the memo even faster. Disclosure leaked on October 20 — including a mistakenly published exploit demo video — and within hours Cloudflare observed attackers using AI assistance to mutate payloads and bypass its mitigations. The same class of tool, in both hands, probing the same crack within hours.
• The NSA took the rare step of a public warning: patch immediately or pull vulnerable systems offline. Japan, the EU, and the UK's NCSC echoed it.

Why it matters

This isn't just another patch Tuesday. PHP2Shell is the first major incident where the full symmetry is documented: AI accelerated the defense's discovery curve and the attacker's iteration curve — on a codebase that's been the web's foundation for decades. Governments spent availability against an unquantified risk. That willingness to go dark may be the story's most honest signal.

Go deeper

Read the full analysis: PHP2Shell: AI Surfaced a Decade-Old Flaw, and Governments Took Their Sites Offline

---

Originally published on Agentic Affairs (https://agentic-affairs.com)