# AI Found Two PHP Flaws, and NSA and FBI Warn Sites to Patch Now

- URL: https://usa-24.com/php2shell-patch-ai-found-flaws/
- Publisher: USA 24
- Section: Artificial Intelligence (AI)
- Published: 2026-10-23T22:02:27.515Z
- Updated: 2026-10-23T22:02:27.520Z
- Topics: PHP2Shell, Web Security, AI Cybersecurity, Vulnerability Disclosure, WordPress

> AI agents helped find two critical PHP flaws that could give attackers access to server files and databases. The NSA and FBI say take affected sites offline if they cannot be patched right away.

## Key takeaways

- Two critical PHP flaws, collectively called PHP2Shell, could give attackers direct access to server file systems and databases.
- The NSA recommended taking affected systems offline if immediate updates are not possible, and the FBI gave operators the same advice for sites that cannot update immediately.
- PHP powers about 70% of the world's websites, and a Drupal Association official said any server running a PHP version released in the last 20 years will be vulnerable.
- Nearly three dozen UK government services were unavailable and four were partially unavailable, according to a UK minister's remarks to the House of Lords.
- Amazon detected attempts to exploit the flaws before public disclosure, and the scale of actual compromises is still unknown.

A pair of critical PHP flaws, found with help from AI agents, has knocked websites and government services offline around the world this week. The U.S. National Security Agency and the FBI now urge operators to patch quickly and, if they cannot, to take affected sites down until a fix is in place. The fix is public, and that combination is what worries security teams most.

The bugs were disclosed on Wednesday, October 21, 2026, and the fallout was still spreading on Thursday and Friday. PHP developers released urgent fixes that day and encouraged all users to update immediately, according to a [Reuters report carried by Global Banking & Finance](https://www.globalbankingandfinance.com/cyber-agency-warns-websites-go-dark-php-prepares-critical/). Our earlier coverage of the PHP2Shell patch tracked attacks and sites going dark. This story covers what is new: AI helped find the flaws, and two U.S. agencies have now issued warnings.

## Which PHP flaws are involved in PHP2Shell

PHP is a server-side programming language, and it powers about 70% of the world’s websites, including sites built on WordPress and Drupal, according to [ABC7 Chicago’s CNN wire report](https://abc7chicago.com/story/php-vulnerability-2026-websites-shut-down-globally-operators-address-ai-detected-flaw-web-programming-language/19968288/). PHP2Shell is a nickname for the two bugs, not a separate program. According to [CNBC](https://www.cnbc.com/2026/10/22/php-google-openai-and-amazon-cyber.html), the flaws could give attackers direct access to server file systems and databases. The FBI’s cyber division warned that they could also let malicious actors execute code remotely, which raises the risk to sensitive data and networks.

Tiffany Farriss, interim chief executive of the Drupal Association, put the reach in plain terms. “This issue impacts the majority of the internet,” she said. She added, “All servers using any version of PHP released in the last 20 years will be vulnerable.” For site owners, an older server is not automatically safe. If a server runs a PHP release from the last two decades, the reporting puts it in scope.

The reporting also says the bugs stayed hidden in the PHP codebase for more than a decade. One Reuters-based report lists the identifiers as CVE-2026-109618 and CVE-2026-109619. Those numbers rest on that single report so far, so verify them against official CVE records before you cite them in a ticket or an audit.

The risk is not limited to large sites. The reporting names U.S. website operators, small businesses and agencies running PHP-based sites as the most directly exposed.

## How AI found the bugs and who gets credit

Teams at OpenAI, at Google-owned Wiz and at another cybersecurity firm uncovered the flaws, according to ABC7’s report. [PBS](https://www.pbs.org/newshour/nation/ai-discovered-a-software-vulnerability-that-could-impact-70-of-websites-worldwide-the-rush-is-on-to-patch-it) reported that AI agents helped uncover the vulnerabilities. Wiz, as quoted in the CNN and ABC7 coverage, described the episode as an “AI inflection point.”

Credit is still taking shape. OpenAI’s exact role in the discovery and any follow-up disclosure is still developing, and one OpenAI statement in the reporting was cut off. Anyone citing the company’s account should wait for the full text.

The attribution matters for a bigger reason. Finding a serious bug in widely deployed code usually takes skilled researchers a long time. When AI agents shorten that search, defenders gain faster tools, but attackers gain them too.

The pattern is reaching other technical fields. [USA 24 reported that Anthropic’s Claude designed scorpion toxin binders, and 17 of them passed lab tests](https://usa-24.com/claude-scorpion-toxin-binders/). The discovery also arrives as concern rises in Washington and Silicon Valley about how AI could supercharge cyberattacks, according to ABC7’s report.

## Which websites and services went dark

The outages have been broad but mostly brief. Some websites briefly went dark after the disclosure, according to [CNN](https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai-intl). The most concrete figures come from the UK and from operators that chose to shut systems down as a precaution:

- Nearly three dozen UK government services were unavailable and four were partially unavailable, a UK minister told the House of Lords, according to CNN.
- Wikimedia said it was addressing the PHP vulnerabilities and took several systems down as a precaution.
- Japan’s government said parts of some of its websites were taken offline temporarily, and it had received no reports of damage from attacks, according to PBS.

The UK figures show that public services are not insulated from a flaw in a common web language. A government portal faces the same underlying exposure as a small business running WordPress, even if it has far more staff to respond.

Amazon adds a wrinkle. [CNBC](https://www.cnbc.com/2026/10/22/php-google-openai-and-amazon-cyber.html) reported that Amazon detected attempts to exploit the flaws before public disclosure, but it remains unclear how attackers obtained information about them. Who carried out those early attempts, and how Amazon’s detections happened, is not explained in the reporting.

## What the NSA and FBI told operators to do

The guidance is blunt. CNBC reported that the NSA recommended taking affected systems offline until the flaws are fully addressed if immediate updates are not possible. PBS reported that the FBI’s cyber division recommended operators take sites offline if they cannot update immediately.

The two agencies frame the step differently. The NSA treats the shutdown as a holding action that lasts until the flaws are fully addressed. The FBI treats it as the right move for any site that cannot update right now. Both point to the same order of operations: patch first, and if patching is impossible, stop exposing the system.

Taking a site down is a blunt tool, and for a business that depends on its website, it costs money. Still, the trade-off favors a short outage over an attacker running code on a server that holds sensitive data. The timing is the real problem. A public fix tells attackers where to look, and experts quoted in the Reuters report say they are bracing for a wave of intrusions.

Costin Raiu, co-founder of the cybersecurity firm TLP:Black, said the next step was the “mass compromise of every vulnerable web server on the internet.” That is a forecast, not a confirmed outcome, and the reporting does not show it has happened yet.

The people with the least control look most exposed. Governments and large companies can often coordinate fixes. Small businesses running WordPress or Drupal on shared hosting depend on their provider’s schedule, and that dependency is where delay is most likely.

## How to check your site and apply the PHP2Shell patch

These steps follow the official guidance described in the reporting:

- Find out whether your public sites run PHP. WordPress and Drupal sites do, so start there, and ask your developer or host if you are unsure.
- Apply the PHP update now. PHP developers released urgent fixes on Wednesday, and Japan’s government said a fix was released late that day, according to PBS.
- If you self-host, the update is yours. If a managed host runs your site, the update may be theirs, but confirm it rather than assume it.
- If you cannot update right away, take the site offline until it is patched, as the NSA and FBI advised.
- Ask your hosting provider whether it has applied the patch to your server, and get the answer in writing if you can.
- Review server and access logs for unusual activity since Wednesday, October 21, and report anything suspicious to your host right away.

## What comes next

Three questions will shape the next week. First, the scale of actual compromises is unknown, and the reporting describes warnings, outages and attempted exploitation rather than confirmed mass breaches. Second, the CVE identifiers rest on a single report. Third, the NSA and FBI advisories have not been confirmed as formal documents on the agencies’ own sites, so readers should look for the originals before relying on secondhand summaries.

Watch whether OpenAI and the other discoverers publish fuller accounts. Watch too for hosting companies to publish their patch status. A provider that answers quickly gives customers what they need to decide whether to keep a site live.

Public unease with AI is already measurable. A [recent USA 24 poll story](https://usa-24.com/americans-oppose-data-centers-poll/) reported that most Americans say AI is bad for society. Whether the PHP episode changes that view is unclear, but the next few days will show whether the patch wave outruns the attackers.

## Frequently asked questions

### Is my website affected by the PHP vulnerability?

Sites built on PHP are in scope, including many WordPress and Drupal sites. The Drupal Association’s interim chief executive said all servers running any PHP version released in the last 20 years will be vulnerable. Check with your developer or host whether your site runs PHP, then confirm the update status with them.

### What is the PHP2Shell patch?

PHP2Shell is the collective name for two critical PHP flaws disclosed on Wednesday, October 21, 2026. PHP developers released urgent fixes that day and encouraged all users to update immediately. Japan’s government said a fix was released late Wednesday.

### Did AI really find the PHP flaws?

PBS reported that AI agents helped uncover the vulnerabilities, and teams at OpenAI, Google-owned Wiz and another cybersecurity firm are credited with the discovery. OpenAI’s exact role is still developing, and one of its statements in the reporting was cut off.

### Have the PHP attacks caused confirmed mass breaches?

Not based on the reporting so far. Coverage describes warnings, outages and attempted exploitation, and the scale of actual compromises is unknown. Amazon detected exploitation attempts before public disclosure, but it remains unclear how attackers obtained information about the bugs.

## Sources

1. [Websites shut down globally after AI finds cybersecurity flaw affecting 70% of the internet](https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai-intl)
2. [Critical PHP web security flaws spark global alarm as Google, OpenAI and Amazon respond](https://www.cnbc.com/2026/10/22/php-google-openai-and-amazon-cyber.html)
3. [AI discovered a software vulnerability that could impact 70% of websites worldwide. The rush is on to patch it](https://www.pbs.org/newshour/nation/ai-discovered-a-software-vulnerability-that-could-impact-70-of-websites-worldwide-the-rush-is-on-to-patch-it)
4. [Some websites shut down globally as operators address PHP issue after AI finds critical flaw](https://abc7chicago.com/story/php-vulnerability-2026-websites-shut-down-globally-operators-address-ai-detected-flaw-web-programming-language/19968288/)
5. [AI-Discovered PHP Vulnerability Shuts Down Government Websites](https://www.globalbankingandfinance.com/cyber-agency-warns-websites-go-dark-php-prepares-critical/)