Tech • AI • Robotics • Game
AI has just revealed a flaw threatening the Internet
9.4/10TL;DR
Emergency fixes for two critical PHP flaws triggered precautionary shutdowns across several countries and highlighted how AI is accelerating the discovery and weaponization of long-hidden software vulnerabilities.
KEY POINTS
Critical flaws in a core web component
On 21 October 2026, the PHP team released emergency patches for two vulnerabilities nicknamed PHP to Shell, rated 9.2 out of 10 in severity. In certain configurations, a single unauthenticated request could force a server to execute attacker-controlled code. Because PHP powers a large share of the web, the issue affected a common foundation rather than one specific site or plugin.
A vast digital footprint
PHP is used by about 70% of websites whose technology stack can be identified, according to W3Techs. It sits behind blogs, online stores, forms and payment pages, and it underpins platforms such as WordPress. That scale explains why the flaws caused immediate concern even though they did not make every site automatically exploitable.
Precautionary shutdowns in several countries
Authorities and major organizations moved quickly to reduce exposure. In France, prefecture websites were taken offline, along with part of the tax portal and Météo-France. Finland disconnected some public services, while in Japan the Finance Ministry, the weather agency, MUFG, Nomura, ANA and JR East suspended parts of their online services. CERT-EU advised institutions to take systems offline if they could not be patched at once.
No confirmed mass breach, but a race against time
Those shutdowns were defensive measures, not evidence of a successful large-scale hack. Finnish officials said they were not aware of active exploitation in state systems. The central problem was speed: once a fix exists, every vulnerable server still has to be found and updated, including old or neglected systems that often remain online for years.
Millions of attack attempts followed the disclosure
Cloudflare reported thousands of exploitation attempts in the 10 hours before the official announcement, tens of thousands within 45 minutes, hundreds of thousands after two hours, and then millions. That did not mean millions of breaches, but it showed how quickly automated scanning spread. Attackers were effectively testing every reachable door to see which ones were still open.
Legacy systems are the weak link
Large hosts and major companies often patched within hours, but smaller firms, agencies and public bodies face a harder task. PHP 8.1 and older branches are no longer maintained, and some older versions received only minimal unofficial backports that must be compiled manually. For many outdated deployments, the real fix is a migration, which can take weeks or months.
A familiar pattern from WannaCry and Log4Shell
The episode resembles past crises in shared software components. WannaCry spread in 2017 despite a patch having existed for two months, infecting more than 200,000 machines in 150 countries. Log4Shell in 2021 showed how a flaw in a widely embedded component can linger for years in unpatched systems, creating a long tail of risk long after the first alerts.
AI helped turn an old bug into a practical exploit
The most striking detail is that the underlying vulnerable code had existed since PHP 5.4 in 2012. Parts of the issue had reportedly been noticed in 2020 and again in 2024, but no one had proved they could be exploited in practice. Researchers at Wiz said they used models including Gemini, GPT and internal tools to find the flaws, develop exploit paths, detect exposure and validate the fix, compressing work that might once have taken months into about a week.
The broader risk is a widening speed gap
The central security question is no longer only whether flaws exist, but whether defenders can patch as fast as new weaknesses are discovered and operationalized. AI may be lowering the skill barrier for both defenders and attackers, especially for adapting exploits to specific versions and configurations. That raises the prospect of more critical flaws being found faster than organizations can repair them.
Finance fears center on confidence, not just code
There is no public evidence that banks were breached through these PHP flaws, but the temporary suspension of some online banking services in Japan showed how even preventive action can fuel uncertainty. A short outage can quickly be misread as theft or insolvency once screenshots and rumors spread online. The collapse of Silicon Valley Bank in March 2023, when customers sought to withdraw $42 billion in one day, illustrated how fast trust can evaporate in a digital panic.
CONCLUSION
The PHP to Shell incident did not bring down the internet or trigger a banking crisis, but it exposed a structural weakness in modern computing: critical shared software can remain vulnerable for years and become dangerous overnight when new tools make exploitation easier. The likely outcome is not collapse, but a prolonged wave of patching, opportunistic intrusions and mounting pressure to update systems far faster than before.
Ask a question