- Two critical PHP vulnerabilities prompted precautionary website shutdowns across several European countries.
- The flaws could allow attackers to execute malicious code remotely on vulnerable servers without authentication.
- Researchers at Calif and Wiz used AI-assisted security tools to help identify the weaknesses.
- Amazon reported detecting an attempted exploit against a honeypot on October 17, four days before public disclosure.
- PHP released security updates on October 21, 2026, and urged users to install them immediately.
Government agencies, hospitals and other organisations across Europe temporarily restricted access to online services after security teams identified serious weaknesses in PHP, software used to run websites and web applications. The response affected public-facing services in countries including the Netherlands, Finland, France and Denmark. Many organisations chose to take vulnerable systems offline while preparing to install security updates. The precautionary action was intended to reduce the risk of remote attacks, rather than indicate that every affected organisation had suffered a breach.
The vulnerabilities were publicly disclosed on October 21 under the identifiers CVE-2026-109618 and CVE-2026-109619. Together, they have been referred to as PHP2Shell and carry critical severity ratings of 9.2 out of 10 under CVSS 4.0. The PHP development team released fixes on the same day and urged administrators to update affected installations without delay.
The Netherlands was among the countries that took preventive action. Its National Cyber Security Centre temporarily shut down its own website, while public services including Overheid.nl, MijnOverheid.nl and DigiD were also affected. The Port of Rotterdam, Dutch football association KNVB and websites belonging to political parties were among the other services reported offline. Several hospital websites or online services were also made unavailable as organisations assessed their exposure.
Finland’s state IT provider, Valtori, took government web services offline as a precaution. France’s Interior Ministry temporarily placed websites belonging to local administrative authorities into maintenance mode, while Denmark reported disruptions after municipal IT provider Kombit suspended several services, including a school communication platform. Some affected services began returning after security fixes became available. The shutdowns demonstrated the operational cost of responding to a critical vulnerability in widely deployed software.
How the PHP flaws could expose vulnerable servers
PHP is a server-side programming language that processes requests and helps websites deliver dynamic content. It is used by many web applications and content management systems, including platforms such as WordPress, Drupal and Joomla. Because PHP runs on servers, weaknesses in its core components can affect the underlying infrastructure rather than just one website’s visible pages. That makes a vulnerability in the language itself a concern for website owners, hosting companies and organisations operating online services.
The two PHP2Shell flaws involve problems with memory handling during request processing. Under certain conditions, the software may mishandle internal data after an error or retain references to memory that has already been freed. An attacker could exploit these weaknesses to execute code remotely on an affected server without first logging in. Depending on the environment, successful exploitation could expose sensitive information or allow an attacker to gain control of parts of a vulnerable system.
The existence of a vulnerability does not mean every PHP-based website can automatically be compromised. The risk depends on factors including the installed version, how PHP is configured and whether the relevant security fixes have been applied. Nevertheless, the PHP security team warned that installations serving web requests needed urgent attention.
The discovery has drawn attention to the growing role of artificial intelligence in cybersecurity research. Calif and Wiz were among the teams that used AI-assisted tools to help identify the PHP vulnerabilities. Such tools can support researchers in examining large codebases, tracing unusual behaviour and identifying programming errors that may otherwise be difficult to spot. The findings show how AI can contribute to defensive security work by helping researchers locate weaknesses before they are widely exploited.
AI did not create the flaws. They were weaknesses already present in PHP’s code, and the research tools helped bring them to light. The same technology, however, can also help attackers study technical disclosures and develop ways to exploit unpatched systems. This creates pressure on software developers and system administrators to move quickly once a vulnerability becomes public.
Amazon reported that its threat intelligence team detected an attempted PHP2Shell exploit on October 17, four days before the vulnerabilities were publicly disclosed. The activity was recorded by MadPot, Amazon’s honeypot system, which is designed to attract and monitor suspicious activity. The attempt originated from an IP address associated with a commercial anonymisation network. Amazon said it was unclear how the actor obtained information about the flaws while the details were still under embargo.
The report raised concerns about whether information on the vulnerabilities had reached potential attackers before the official announcement. Amazon also identified further proof-of-concept activity around the time of disclosure. An attempted attack against a honeypot does not prove that a real website was compromised, but it provides an indication that someone was testing a potential exploit. Security teams therefore faced the need to patch vulnerable systems while checking for signs of suspicious activity.
PHP releases fixes and urges immediate updates
The PHP development team published patched releases for several supported versions on October 21. These include PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The official security advisory says updating is the only complete fix and urges users to install the relevant release as soon as possible. Organisations should confirm which PHP versions their servers and applications are using before selecting the appropriate update.
Older versions that no longer receive support may need special attention because they do not necessarily receive fixes through the standard release process. Website owners should check with their hosting providers or software distributors to confirm whether a suitable patch is available. Where an exposed service cannot be updated promptly, administrators should assess whether it needs to remain accessible to the public internet. Security agencies have also advised organisations to prioritise internet-facing systems and keep unpatched services offline where necessary.
Installing an update is also not a substitute for checking whether a system was attacked before the fix was applied. Administrators should review relevant logs, investigate unusual activity and assess whether there are signs of unauthorised access. A patched server may still require further investigation if it was exposed during the period when the vulnerability remained unaddressed.
The PHP2Shell incident highlights the dependence of public services and private organisations on shared software infrastructure. A weakness in a widely used programming language can affect websites operated by different organisations, even when those organisations have built entirely separate services. That can leave administrators dealing with the same urgent security problem across many systems at once. For website owners, keeping track of software versions and applying security updates promptly are essential parts of maintaining a safe online service.
AI-assisted research may help defenders discover vulnerabilities faster, but speed of discovery is only one part of the process. Developers must release reliable fixes, hosting providers need to make updates available and website operators must install them correctly. Attackers may also move quickly once details become public, increasing the pressure on organisations that delay patching. The priority following PHP2Shell is to secure vulnerable installations and investigate any signs of earlier exploitation.
