# AI-Discovered PHP Flaws Spark Global Cyber Scramble

> Millions of hacking attempts targeted critical PHP vulnerabilities, known as "PHP2Shell," before patches were available, forcing websites offline worldwide.

By PrimaryBrief newsroom · Published 2026-10-22T14:33:42.381769Z
Canonical: https://primarybrief.com/article/ai-discovered-php-flaws-spark-global-cyber-scramble-dab7e018

Critical vulnerabilities dubbed "PHP2Shell" in the PHP programming language, which underpins about 70 percent of the world's websites, triggered a global cybersecurity crisis this week [5][11]. Attackers launched millions of hacking attempts starting October 17, 2026, four days before security patches were released on October 21, 2026 [3][5]. This rapid pre-patch exploitation, accelerated by artificial intelligence, illustrates a significant challenge: the time between discovering a flaw and its active exploitation is now shorter than the time to patch it, forcing governments and businesses worldwide into a scramble [1][3][10].

## What the records show

Artificial intelligence uncovered these long-hidden programming flaws in PHP, prompting a global cybersecurity response [1]. These vulnerabilities impact a substantial portion of the internet, with a cloud firm reporting "millions of hacking attempts" targeting the flaws [5][11]. The pre-patch exploitation of PHP2Shell has been described as unprecedented [3][9]. Approximately 70 percent of the world's websites use PHP, making the potential impact widespread [5]. Government security agencies issued warnings for companies to act immediately after the AI discovery [4].

## The timeline

Attackers began exploiting the PHP2Shell vulnerabilities around October 17, 2026, four days prior to the release of official security patches [3]. The patches became available on Wednesday, October 21, 2026 [3]. Following the patch release, governments and businesses globally began urgently applying fixes and preventing further exploitation on October 22, 2026 [11].

## What changed and for whom

Governments and businesses across the world, including those in Kenya and the Netherlands, are actively working to prevent exploitation [2]. In the United Kingdom, 32 government services were taken offline for preventative measures or patching [6]. The National Cyber Security Centre (NCSC) described the scale of the issue as "unprecedented" [9]. This event shows the accelerating threat environment, where AI contributes to faster vulnerability discovery and exploitation [8][10]. The window between a vulnerability's public disclosure and its first observed exploitation dropped to negative eight hours by July 2026, according to a Radware report [7]. Qualys research indicates a mean time to exploitation of about minus seven days [8].

## What the subject has said publicly

Ollie Whitehouse, Chief Technology Officer for the NCSC, stated that the organization had been conducting a "co-ordinated disclosure process" to warn organizations after the vulnerability was identified months ago [9]. Whitehouse noted that an initial version of the patch was released, making it "very easy to compare the original with the patched version and see which bit of code you needed to go and exploit" [9]. He added that "somebody let the cat out of the bag" the day before the full patch was available [9].

## What we could not confirm

We could not confirm the exact number of websites successfully compromised due to the PHP2Shell vulnerabilities before patches were applied. The total financial impact of the global patching effort and any associated downtime remains unclear. The specific AI model or company responsible for the initial discovery of the flaws has not been fully detailed across all evidence, although one report mentioned Ryan Austin, a researcher at Calif using an OpenAI model [9].

## Evidence cited
1. What is PHP and why did it spark a global cyber-security scramble? (www.bbc.co.uk) — https://www.bbc.co.uk/news/articles/c3qjnwye0ep5o?at_medium=RSS&at_campaign=rss
2. Global Rush to Fix PHP Security Flaw Leaves Some Websites Offline (www.nytimes.com) — https://www.nytimes.com/2026/10/22/world/php-vulnerability-websites-cybersecurity-ai.html
3. Amazon says PHP2Shell exploitation began 4 days before patches (www.bleepingcomputer.com) — https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/
4. Websites taken offline in race to patch PHP security flaw (www.ft.com) — https://www.ft.com/content/d438af1e-a48c-4aeb-8c84-00cdb5e741e3?syn-25a6b1a6=1
5. Hacking attempts surge as websites race to patch PHP issues (www.abc.net.au) — https://www.abc.net.au/news/2026-10-23/php-vulnerabilities-ai-hacks-surge/107299204
6. ‘No indications’ PHP code flaw has led to government systems being hacked, cyber security official says – UK politics live (www.theguardian.com) — https://www.theguardian.com/politics/live/2026/oct/22/john-healey-chancellor-budget-red-tape-small-businsesses-jackdaw-oil-latest-news-updates
7. The Average Vulnerability Exploitation Time Is Now Negative Eight Hours, Radware Says (hostingadvice.com) — https://hostingadvice.com/
8. Threat Landscape Report 2026 | Qualys, Inc. (qualys.com) — https://qualys.com/
9. UK minister tells civil servants to ignore calls to return to office (newswav.com) — https://newswav.com/
10. AI is shrinking the gap between vulnerability disclosure and exploitation from weeks to hours (computerworld.com) — https://computerworld.com/
11. PHP2Shell: Global Cyber Scramble Unfolds After AI Reveals Critical PHP Flaws – Global Banking & Finance Review (globalbankingandfinance.com) — https://globalbankingandfinance.com/