PHP2Shell: What an AI-Found Flaw Means for Your Website

Websites switched off on purpose

This week, websites across Europe went dark on purpose. Government departments in Germany, France, Belgium, the Netherlands and Finland, along with Wikimedia, took sites offline while they waited for a fix to two critical flaws in PHP, the software that runs around 70% of the web. The flaws were found with the help of AI. In our view, that is the real story: AI is speeding up both sides of web security, and how quickly a fix is applied now matters more than ever.

We've taken a closer look at what happened, what it means for small businesses, and how we handled it for our clients.

What happened

PHP is the language behind most websites, from small business sites and blogs to council portals. On 20 October 2026, the PHP team announced two critical flaws, known as CVE-2026-109618 and CVE-2026-109619, and said a fix would follow the next day. They have been nicknamed "PHP2Shell".

In plain terms, the flaws could let an attacker run their own code on a web server without logging in. That could mean changing pages, slipping in malware or taking data. Both were rated 9.2 out of 10 for severity. They affect versions of PHP going back more than a decade, and they sit in PHP itself, so a carefully built website was no safer than a badly built one.

The plan was a calm, coordinated release. It didn't work out that way. Details leaked online before the fix was ready, so attackers learned about the flaws at the same time as everyone else, and Cloudflare reported early attacks before any fix existed. That is why so many organisations chose to switch their sites off rather than wait.

The UK's National Cyber Security Centre (NCSC) told organisations to update straight away. If they couldn't, it advised applying temporary measures and, failing that, taking unpatched sites offline.

PHP released the fix at 3pm UK time on 21 October.

How AI found it

The flaws were found by security researchers using AI. Wiz Research says it found the first one on 19 August, using its own tool, Wiz Atlas, together with Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol, and reported it to PHP five days later. The security firm Calif also found one of the flaws using GPT-5.6 Sol, as part of an OpenAI programme. PHP's advisory credits researchers from Calif, Wiz and OpenAI. Wiz also used AI to help check that the fix worked. The fix itself was written and released by the PHP security team.

Wiz says the underlying bugs had been in PHP for decades. Showing they could actually be used in an attack took a long chain of steps, "at the edge of what human researchers could practically achieve". AI brought that within reach.

That is good news. These flaws were found by people trying to protect the web, and fixed in a planned way rather than after a wave of break-ins.

The flip side

The same tools are available to attackers. If AI can help a researcher turn an old bug into a working attack, it can help a criminal do the same once a fix is published, by working out what the fix changed. One security firm, Sansec, expected mass attacks to start within 15 minutes of the fix being released.

In our experience, small business websites are rarely attacked because someone has picked them out. They are attacked because automated tools scan the whole internet for anything that responds, and a small site is found as easily as a large one.

So the risky period is the gap between a fix being released and being applied. AI is making that gap more dangerous, and it is the part a business, or the people who look after its website, can actually control.

How Cow-shed responded

We picked up the news on the afternoon of 21 October. We used AI to quickly assess the risk to our sites, confirmed exactly which version of PHP they were running, and contacted our hosting provider straight away.

All our client sites were on the patched version the same day, within three hours of the fix being released. We then checked every site individually to confirm. There has been no sign of any problem.

Two things worked in our favour. Our sites don't use databases, so there is very little data that could be taken. And we keep full backups of every site, so if anything had been changed, we could put a clean copy back quickly.

What this means for you

You don't need to understand PHP to protect your business. You just need to know that someone is watching for this kind of news and acting on it. A few questions worth asking whoever looks after your website:

How quickly do you apply security updates, and how do you check they've been applied?

Is the software my site runs on still supported and up to date?

Do you keep full backups, and how quickly could you restore my site?

If a serious flaw is announced and can't be fixed straight away, what's the plan?

If you're not sure how your website would fare, or you'd like us to take a look, get in touch. We're always happy to talk it through.

Emma at Cow-shed