Global Websites Go Offline Due to AI-Uncovered PHP2Shell Vulnerability

A pair of critical security vulnerabilities in the PHP programming language — which powers approximately 70% of all websites worldwide, including platforms built on WordPress and Drupal — triggered a global cybersecurity emergency this week. This forced governments and major companies to take their websites offline to apply emergency patches.

The flaws, collectively dubbed “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619), were discovered by teams at OpenAI, Google-owned Wiz, and cybersecurity firm Calif. Both vulnerabilities received a critical severity score of 9.2 out of 10 and can enable remote code execution. This allows attackers to take control of a web server without authorization and steal sensitive data such as passwords.

The fallout has been sweeping. Wikipedia and Wikimedia took services offline to apply patches, the Internet Archive went dark, and French telecom giant Orange suspended access to several websites and apps as a precautionary measure.

Government websites across France, Denmark, Finland, Germany, and the Netherlands also went temporarily offline. In Japan, airline ANA, railway operator JR West, and major bank MUFG reported suspended web services. The U.S. National Security Agency and Europe’s cybersecurity agency issued urgent advisories.

Emergency patches were released in PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. OpenAI called the discovery “one of the most impactful security issues in recent memory.”

Source: Axios — The internet’s hidden security nightmare — and how AI exposed it