AI broke the internet. PHP2Shell is what it looks like.

PHP is the programming language running behind almost 70% of websites, including every WordPress site. The 2 flaws, now called PHP2Shell, are rated 9.2 out of 10. They sit in PHP itself, in the memory handling and error handling that nearly every request touches. In plain terms, someone on the other side of the world could send a crafted request to your site and end up running their own commands on your server. No login needed, and on some setups before any of your own code even runs.

The release was planned for 22 October. The bug IDs leaked online on 20 October, so the PHP project moved it forward a day and shipped PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on 21 October. The NSA told organisations to patch immediately and said that if an update was not feasible, they should take the system offline until it was fixed. The FBI told teams to watch for PHP processes unexpectedly launching command shells or downloading files.

Governments took that advice. France took its prefecture websites offline. Finland's state IT centre shut down the government's public web services. In the Netherlands the government portal Overheid.nl, the Port of Rotterdam and the football association went dark, and Germany's federal IT provider pulled several sites. The Wikimedia Foundation took a number of its systems down while it patched.

Cloudflare's CEO, Matthew Prince, described how fast the attempts grew: thousands in the 10 hours before the announcement, tens of thousands in the 45 minutes after it, hundreds of thousands within 2 hours, then millions. Amazon found an attempt on one of its decoy servers on 17 October, 4 days before the fix went public.

In fairness, no government has reported a breach. Finland said it found no attempt to exploit the flaws, and the PHP security team found no working exploit among the code circulating at the time of release. Millions of attempts is not millions of breaches. It does show how short the gap now is between a fix going public and people trying to use it.

In 2024 PHP had its first external security audit in years, carried out by the firm Quarkslab. While fixing one of the issues it found, a PHP core developer spotted the first signs of the memory problem behind one of the 2 flaws. Nobody could find a concrete way to exploit it. The team tried several fixes, each one breaking something else, and because it decides by consensus the work stalled and restarted for months. The PHP Foundation now calls the delay "a structural failure" and blames its own decision process and lack of resources.

Then on 30 July 2026 the security firm Calif started auditing PHP through OpenAI's Patch the Planet programme. On 11 August Calif reported a working attack with the same root cause. OpenAI's own researchers reported the same root cause independently, and Wiz reported more ways in on 24 August. Calif and Wiz both say they used AI models to do it. The bug a human team saw in 2024 and parked became an emergency once AI-assisted researchers showed it could be used.

AI is also changing the volume. The Foundation says AI-assisted research means far more reports: it has published 15 vulnerabilities since 1 July and worked through more than 100 reports that turned out to be invalid, duplicates or impossible to reproduce. It had already scanned PHP with Anthropic's Claude Mythos earlier this year.

The bigger problem, AI finding flaws faster than people can fix them, has been building for about 2 years. In November 2024 Google said its Big Sleep AI agent had found an exploitable flaw in SQLite, a database built into most phones and web browsers, and called it the first public example of its kind. On 7 April 2026 Anthropic announced Claude Mythos Preview through Project Glasswing and said it had found thousands of previously unknown flaws across every major operating system and web browser, including a 27-year-old bug in OpenBSD that let anyone crash a machine just by connecting to it. Anthropic has said it does not plan to make the model generally available.

The research group Epoch AI tracks high and critical severity flaws published by 21 large software organisations, including Microsoft, Google, Apple, Cisco and the Linux project. I rebuilt their chart below from the published data.

For 4 years the line climbs slowly. The record before Mythos was 494 serious flaws in September 2025. Then April 2026 hit 698, May 1,055, June 1,549, and July 2,512. That is about 5 times the old record in a single month.

Google's threat intelligence group sees the same thing across all disclosures: 5,045 in January 2026 and 10,740 in August. More worrying, it counted 141 flaws actually exploited in the wild in the first 8 months of 2026, already more than the 127 it saw in the whole of 2025.

So why now? I think 3 things landed at once. Finding flaws got cheap, because models can now read a codebase the way a senior security researcher would, at a scale no team can match. Using flaws got cheap too. Amazon's security chief, CJ Moses, said AI-assisted analysis makes it cheaper to turn a patch or an advisory into a working exploit, so more attackers can act within hours or even minutes. And PHP2Shell hit something almost everyone uses, so it stopped being a story for security people and became a story about government websites going offline.

Both numbers need context. Epoch counts flaws by when they were published, which shows a strong link to AI-assisted discovery without proving it caused all of it. Google says raw totals overstate the threat, partly because some open-source projects now assign IDs automatically (the Linux kernel alone produced about 5,000 this year with no zero-day attacks seen), and only about 1 in 431 disclosed flaws this year was seen being exploited. Every flaw on that chart is also one that got found and, in most cases, fixed. The problem is the timing, because attackers only need the window between disclosure and patch, and Amazon now tells defenders to measure that window in hours, not days.

PHP is not inherently insecure. It has run a huge part of the web for about 30 years, and it is still maintained. The environment it runs in is what changed. For decades, finding a flaw like this took rare expertise and a lot of time, and that cost was itself a kind of protection. Most code was safe because nobody capable had looked closely enough yet.

AI removes that cost. And a lot of the internet is running versions PHP no longer supports. PHP 8.1 and older get no official release for PHP2Shell, only minimal source patches for people who build PHP themselves. Two scans this week put numbers on it. Modat found 4.38 million PHP services facing the internet, 79% of them on unsupported versions, with PHP 7.4 alone running 878,761. CybelAngel counted 2.24 million PHP hosts, 59% on versions with no fix coming. The methods differ, and both say most of it is out of support.

That is the part that worries me most for small businesses. The site a developer built in 2019 and nobody has touched since is still out there, still answering requests, and now any reasonably capable attacker can point a model at it.

Patch windows will be measured in hours. Amazon's advice after PHP2Shell was to start any investigation from the earliest known attack date, not the disclosure date. If your plan for a critical update is to get to it next sprint, the plan is already out of date.

Responsible disclosure is under strain. The usual model is that researchers tell the maintainers, everyone agrees a date, and patches go out before the details do. With PHP2Shell the bug IDs leaked 2 days early, one of the research firms published a demo video by mistake, and a vendor shipped fixed builds more than 6 hours before the release, which let anyone study what had changed. Expect more of that as more people, and more AI tools, find the same bugs at the same time.

Open-source maintainers will need far more support than they get. PHP runs most of the web, and its own foundation says a lack of resources is part of why a flaw spotted in 2024 was still there in 2026. It is now asking the companies that depend on PHP to fund that work. The same is true of a lot of the software under your website, your CRM and your phone system.

Dr Barry Scannell, an AI law partner at William Fry, put the wider worry plainly this week: "I am increasingly concerned that we are flirting with a loss-of-control situation." I don't think that is alarmist. Our security habits assume a person finds the flaw, writes the attack and decides when to use it. Each of those steps can now be handed to a model, and that assumption gets weaker every month.

So why aren't more companies using AI to audit their own systems, code and tech stacks? The attackers already are. Defending against AI-assisted attacks without using AI yourself is increasingly like bringing a stick to a sword fight.

You don't need a security team to start. You need to know what you run. Ask whoever built or hosts your site which PHP version it is on and when it was last updated and get the answer in writing. On 23 October PHP also advised turning off a feature called session upload progress until its next regular release, to close a related and unlikely attack path, so ask about that too. Put a web application firewall in front of the site, which is a filter that blocks known attack patterns before they reach your server. Cloudflare's PHP2Shell rules went out to free-plan customers as well, though Cloudflare itself says you still need to patch.

Then make checking a habit. I run an AI-assisted check on this website every 2 weeks, using Claude and an open-source scanner called OSV-Scanner. It covers security advisories for the code we depend on, changes from the providers we rely on, our own code and any errors in production. The last one ran on 22 October. This site does not run on PHP, so PHP2Shell was not our problem this time, but the next one could be, and the check is how I would find out before a client did.

Use AI alongside proper security practice and experienced professionals. It finds things fast, and it gets things wrong. A person still has to check what it says and decide what to fix first, and a team that knows what these tools can and cannot do gets far more out of them, which is what AI training is for. Used together, they close the gap between disclosure and patch far faster than either does alone. If you want to know where AI fits in your own setup, an AI audit is the place to start, and you can book one here.

I'm not a penetration tester, and nothing here replaces one for a business that handles sensitive data. It is still early. But AI is moving fast, and the way most businesses approach security needs to catch up.

• PHP project, security advisory for CVE-2026-109618 and CVE-2026-109619, 21 October 2026, and the informational advisory on session upload progress, 23 October 2026.
• The PHP Foundation, Today's PHP Security Release, and How We're Strengthening PHP Security, 21 October 2026.
• NSA, Critical Patches Recommended for PHP Vulnerabilities, 21 October 2026.
• Reuters, governments and companies take websites offline over PHP vulnerabilities, via The Korea Times, 23 October 2026.
• The Register, Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure, 22 October 2026 (Matthew Prince figures).
• Amazon Threat Intelligence, PHP2Shell exploitation prior to public disclosure in MadPot, AWS Security Blog, 21 October 2026.
• The Hacker News, Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed, 22 October 2026 (CJ Moses, FBI and Modat).
• Cloudflare, Cloudflare deploys protections against php2shell vulnerability, 21 October 2026.
• CybelAngel, What We Know About php2shell, October 2026.
• Epoch AI, Disclosed CVEs: July reached 5× the pre-Mythos record, data updated 3 August 2026.
• Google Threat Intelligence Group, Vulnerability Discovery and Exploitation Trends in the AI Era, 30 September 2026.
• Google Project Zero, From Naptime to Big Sleep, November 2024.
• Anthropic, Project Glasswing, 7 April 2026.