AI-Discovered PHP Flaws Spark Global Cyber Scramble

Critical vulnerabilities dubbed "PHP2Shell" in the PHP programming language, which underpins about 70 percent of the world's websites, triggered a global cybersecurity crisis this week[5][11]. Attackers launched millions of hacking attempts starting October 17, 2026, four days before security patches were released on October 21, 2026[3][5]. This rapid pre-patch exploitation, accelerated by artificial intelligence, illustrates a significant challenge: the time between discovering a flaw and its active exploitation is now shorter than the time to patch it, forcing governments and businesses worldwide into a scramble[1][3][10].

What the records show

Artificial intelligence uncovered these long-hidden programming flaws in PHP, prompting a global cybersecurity response[1]. These vulnerabilities impact a substantial portion of the internet, with a cloud firm reporting "millions of hacking attempts" targeting the flaws[5][11]. The pre-patch exploitation of PHP2Shell has been described as unprecedented[3][9]. Approximately 70 percent of the world's websites use PHP, making the potential impact widespread[5]. Government security agencies issued warnings for companies to act immediately after the AI discovery[4].

The timeline

Attackers began exploiting the PHP2Shell vulnerabilities around October 17, 2026, four days prior to the release of official security patches[3]. The patches became available on Wednesday, October 21, 2026[3]. Following the patch release, governments and businesses globally began urgently applying fixes and preventing further exploitation on October 22, 2026[11].

What changed and for whom

Governments and businesses across the world, including those in Kenya and the Netherlands, are actively working to prevent exploitation[2]. In the United Kingdom, 32 government services were taken offline for preventative measures or patching[6]. The National Cyber Security Centre (NCSC) described the scale of the issue as "unprecedented"[9]. This event shows the accelerating threat environment, where AI contributes to faster vulnerability discovery and exploitation[8][10]. The window between a vulnerability's public disclosure and its first observed exploitation dropped to negative eight hours by July 2026, according to a Radware report[7]. Qualys research indicates a mean time to exploitation of about minus seven days[8].

What the subject has said publicly

Ollie Whitehouse, Chief Technology Officer for the NCSC, stated that the organization had been conducting a "co-ordinated disclosure process" to warn organizations after the vulnerability was identified months ago[9]. Whitehouse noted that an initial version of the patch was released, making it "very easy to compare the original with the patched version and see which bit of code you needed to go and exploit"[9]. He added that "somebody let the cat out of the bag" the day before the full patch was available[9].

What we could not confirm

We could not confirm the exact number of websites successfully compromised due to the PHP2Shell vulnerabilities before patches were applied. The total financial impact of the global patching effort and any associated downtime remains unclear. The specific AI model or company responsible for the initial discovery of the flaws has not been fully detailed across all evidence, although one report mentioned Ryan Austin, a researcher at Calif using an OpenAI model[9].