Updated October 23, 2026.
Security researchers have discovered two critical PHP vulnerabilities that could allow attackers to remotely execute commands on web servers. Artificial intelligence played a key role in identifying the flaws and demonstrating their severity. Dozens of companies and government services worldwide temporarily took their websites offline while security patches were being applied. Meanwhile, Cloudflare has already recorded millions of attempts to exploit the vulnerabilities, and the number is likely to keep growing.
Dozens of websites taken offline across several countries as Cloudflare records millions of attack attempts
On October 21, government websites and online services in several countries began shutting down as an emergency precaution. The cause was two critical vulnerabilities in PHP, a programming language used by nearly 70% of websites worldwide. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619 and collectively known as PHP2Shell, could allow attackers to remotely execute malicious code on servers under certain conditions.
In the Netherlands, government e-service portals were temporarily unavailable, while several government agency services in Finland were also affected. Similar measures were taken in France, Germany, Belgium, and other countries. The shutdowns also affected websites belonging to hospitals, educational institutions, and private companies.
Organizations restricted access to their websites to protect them from potential attacks until security updates could be installed. Their concerns were justified: cybercriminals had already begun attempting to exploit the vulnerabilities before they were publicly disclosed. Ten hours before the official announcement, Cloudflare recorded several thousand exploitation attempts. Following the public disclosure, malicious activity surged dramatically. Within the first 45 minutes, attempts reached tens of thousands. After two hours, the number had climbed into the hundreds of thousands. By October 22, millions of exploitation attempts had been recorded.
Protect yourself from dangerous websites
Cybercriminals can exploit vulnerabilities like these to compromise websites and distribute malware. Kaspersky Premium blocks dangerous websites and malicious downloads, helping protect your devices and personal information.
Try Kaspersky Premium for freeAI helped demonstrate the severity of a PHP vulnerability first identified in 2024
PHP developers first noticed signs of one of the vulnerabilities back in 2024. Following an independent security audit, researchers identified a memory management issue and suspected it could potentially be exploited. However, at the time, they were unable to demonstrate that the vulnerability could lead to remote code execution. Fixing the issue was postponed because changes could disrupt PHP's compatibility with other components, while the small development team lacked the resources needed to address such a complex problem.
The situation changed in the summer of 2026, when artificial intelligence was brought into the investigation. On August 11, a researcher from Calif used the GPT-5.6 Sol model to confirm that the vulnerability could enable unauthenticated remote code execution on a server. The researcher reported the findings to PHP developers. That same day, OpenAI independently submitted a report identifying the same issue. Researchers at Wiz later presented their own findings, using several AI tools, including Gemini 4 Argon. These AI models helped researchers analyze source code, develop proof-of-concept attack scenarios, and test potential fixes.
Once researchers demonstrated the severity of the vulnerabilities, addressing them became a priority for the PHP Foundation. On October 21, PHP maintainers released patched versions: 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Both vulnerabilities, each assigned a severity score of 9.2 out of 10, were fixed in these releases.
How to protect your websites in the age of AI
Artificial intelligence is helping security researchers identify software vulnerabilities faster, including flaws that have gone unnoticed for years. For example, approximately 2,700 critical vulnerabilities were discovered worldwide in the second quarter of 2026, representing a 34% increase compared to the same period the previous year. Experts attribute part of this increase to the growing use of AI, which makes it possible to analyze large volumes of source code more efficiently.
However, cybercriminals can also use AI to investigate newly discovered vulnerabilities and develop attack methods more quickly. As a result, organizations have increasingly less time between the public disclosure of a vulnerability and the first attempts to exploit it.
To improve website security, website owners and server administrators should take the following steps:
- Monitor security releases and install updates promptly. When a critical vulnerability is disclosed, applying the relevant security patch as quickly as possible is essential. For PHP2Shell, website owners should update PHP to a secure version. If an immediate update is not possible, temporarily restrict public network access to the vulnerable service.
- Protect websites against exploitation attempts. Use web application firewalls (WAFs) to analyze incoming requests and block malicious traffic. For example, Kaspersky's WAF uses machine learning and filtering rules to identify suspicious requests, including attempts to exploit vulnerabilities in web application code. This protection helps reduce the risk of attacks while administrators deploy security patches.
- Monitor server security and software versions. Regularly check the versions of installed software, including applications and services that are older or rarely used. This helps identify systems that may have missed important security updates.
Related articles:
- What is a zero-day attack? Definition and explanation
- How AI and machine learning in cybersecurity are shaping the future
- What are web threats?
Recommended products:
