Photo: Pexels
On Wednesday, October 21, some of the busiest websites on the internet were quietly running with a hole in their foundations — and within hours of the hole becoming public knowledge, attackers around the world were racing to walk through it. Governments in Europe and Japan took public websites offline as a precaution. Banks suspended internet services. The chief executive of Cloudflare watched exploitation attempts climb from thousands to millions in less than a day.
The cause was two critical vulnerabilities in PHP, the programming language that quietly powers a vast share of the world's websites — everything from banking portals to airline booking systems, tax filing sites to government services. The flaws had been sitting in the software for years. They were found with the help of artificial intelligence. And the speed at which the internet reacted — and attackers reacted — tells you everything about how cybersecurity works in 2026.
Here is what actually happened, why it matters far beyond server rooms, and what anyone who runs a website needs to do right now.
What was disclosed on October 21
On Wednesday morning, the developers behind PHP released emergency fixes for two vulnerabilities, tracked in security advisories as CVE-2026-109618 and CVE-2026-109619. Their message was blunt: all users were "encouraged to update immediately." The patched versions went out for the supported PHP 8.x branches — 8.2.35 and above, 8.3.36 and above, 8.4.27 and above, and 8.5.12 and above. Anyone running an older, unsupported version has no fix waiting for them at all.
The vulnerabilities are rated 9.2 out of 10 on the severity scale, according to security researcher Anirudh Batra of CloudSEK, as reported by the Economic Times. That puts them among the worst security holes disclosed in recent years. The comparison everyone in the industry reached for was Log4Shell — the 2021 flaw in the Java logging library Log4j, rated a perfect 10, which drew more than 25 million hacking attempts and cost companies an average of about $90,000 just to respond to, according to CloudSEK. Organizations are still spending money defending against that flaw, five years later.
What made Wednesday's disclosure particularly alarming was how long the flaws had gone unnoticed. Per Reuters, they had been lurking in PHP's code for years before being uncovered using AI — machine-assisted code analysis finally catching what human reviewers had walked past for a very long time.
How attacks escalated within hours
The most striking part of the story is not the flaws themselves. It is the timeline of what happened next — and how precisely Cloudflare measured it.
Matthew Prince, the chief executive of Cloudflare, posted the numbers on X late on Wednesday. In the ten hours before the vulnerabilities were publicly announced, Cloudflare's network saw thousands of exploitation attempts — attackers who had apparently already figured out what was coming, or were probing speculatively. Within 45 minutes of the public announcement, that number had jumped to tens of thousands. Within two hours, hundreds of thousands. And then, Prince wrote, "millions now."
That escalation is the new reality of software vulnerabilities. The moment a flaw becomes public, the race begins — and it is not a race between a handful of sophisticated hackers. It is automated, global, and instant. Security firms around the world were reporting similar surges. The window between "vulnerability announced" and "everyone is being attacked" is no longer measured in days. It is measured in minutes.
Governments and banks shut things down
The response from institutions was as fast as the attacks — and unusually dramatic. According to Reuters, government websites in Europe and elsewhere went offline on Wednesday as operators scrambled to protect their systems. The Economic Times reported that authorities in France, Germany, the Netherlands, Denmark, Belgium, Finland, the UK and the US took down websites serving public authorities, hospitals, schools and critical infrastructure as a precaution.
In Japan, the reaction was especially visible. Prime Minister Sanae Takaichi took to X on Wednesday with an unusual public warning, urging website owners to check whether their sites use PHP and prepare to apply the new fix. The country's Finance Ministry temporarily suspended some website content and services while security measures were put in place. Mitsubishi UFJ Financial Group, Japan's biggest lender, said it was temporarily suspending some internet services as an emergency measure.
Reuters further reported that the emergency shutdowns stretched across banking, airline, rail, tax and government services from Tokyo to Helsinki — a reminder of just how much of public and corporate life runs on this single piece of software, and how hard it is to fix something everywhere at once once it breaks in public.
It was not all catastrophe. Finland's national IT center, Valtori, reported that while the threat was real, it had seen no outages caused by successful attacks — a sign that the precautionary shutdowns and rapid patching did what they were supposed to do.
Even Microsoft's chief executive weighed in. Speaking at a company event in Cologne on Thursday, Satya Nadella told the audience: "It was a long day and a long night, I know for all the IT and security folks … I've not seen anything like this in a long, long time." The episode, he said, underscored the importance of building digital systems that can actually be maintained securely — a sentence worth remembering.
Why these flaws are so dangerous
A severity rating of 9.2 out of 10 is not awarded lightly. According to reporting from the Economic Times, exploiting these flaws could let an attacker bring down a website entirely, steal passwords, and compromise sensitive information. In practical terms, that means anyone running an unpatched PHP installation was potentially exposing everything their site handles — user accounts, payment details, internal documents.
What makes PHP vulnerabilities uniquely dangerous is distribution. This is not some obscure library used by a niche corner of the industry. PHP is the backbone of a huge portion of the web — including, as this week's shutdowns showed, the sites governments use to deliver services to citizens and banks use to serve customers. When the flaw is in something this widespread, the number of vulnerable targets is essentially uncountable, and many of them belong to organizations that will take days or weeks to patch.
That lag is exactly what attackers exploit. The Prince timeline tells the story: thousands of attempts before disclosure, millions after. Every hour a website stays unpatched is an hour in which automated attack tools — themselves increasingly AI-assisted — are knocking on its door.
The AI angle: machines finding the machines' mistakes
Here is the detail that makes this story about more than one bad week for IT departments. The flaws were discovered using artificial intelligence — AI-assisted analysis of PHP's own source code, finding what years of human review had missed.
This is the new normal, and it cuts both ways. On one side, AI is becoming the best tool security researchers have ever had for finding vulnerabilities before criminals do. Codebases the size of PHP's are simply too large for any human team to audit line by line; machine-assisted analysis can read everything, remember everything, and spot patterns a tired reviewer at 2 a.m. never would. The fact that these flaws were found by AI rather than by an attacker is, in a sense, the system working.
On the other side, the same capability will not stay in friendly hands. Palo Alto Networks, in comments carried by the Economic Times, described the PHP episode not as an isolated incident but as "the opening chapter in a massive acceleration of cyberthreats that will define foreseeable future." That is not hype. If AI can find vulnerabilities in hours that humans missed for years, then the pace of both discovery and exploitation is about to change permanently — on both sides of the fight.
The deeper pattern is this: the disclosure clock is collapsing. Prince's numbers show the exploitation window is now measured in minutes, while the patching window — getting fixes tested and deployed across millions of servers — is still measured in days or weeks. That gap is the most dangerous number in cybersecurity, and AI is making it wider, not narrower.
What website owners and businesses must do now
If you run a website — or pay someone who does — Wednesday's alert was not someone else's problem. Here is the practical checklist.
1. Find out if your site uses PHP. If your site runs on WordPress, Drupal, Joomla, Magento, or most custom-built sites with a login, contact form or database, it almost certainly does. Your hosting provider's control panel usually shows the PHP version. If you do not know how to check, ask your host or developer directly — this is the single most important question of the week.
2. Update to a patched version immediately. The fixes are out for the supported PHP 8.x branches. Your host may have already applied them — many did within hours — but do not assume. Confirm it.
3. If you are on an old, unsupported PHP version, you have no patch. This is the hard truth buried in the advisories: if your site is running a PHP version that is no longer supported, there is no security update for you. The entire system must be upgraded. Security teams describe the options as distribution backports, vendor fixes, or migration — but doing nothing is not one of them.
4. Watch for signs of compromise. Attack attempts surged into the millions. If your site was unpatched during Wednesday and Thursday, assume it was probed. Check server logs for unusual activity, look for unfamiliar admin accounts or files, and change passwords and API keys if anything looks off.
5. Treat this as the drill, not the exception. There will be another disclosure like this one. The organizations that fared best this week were the ones with patching processes already in place — not the ones scrambling to invent one on Wednesday afternoon.
What this week revealed about the internet's real weakness
Step back from the incident itself, and a bigger picture comes into focus. The internet's most critical software is maintained by a tiny number of people relative to its importance. PHP is free, open-source software. The fixes that protected millions of websites this week were written by its volunteer-backed development community and shipped on an emergency timeline that would strain any organization.
That is the arrangement the entire digital economy quietly depends on: infrastructure with planetary reach, maintained on a shoestring. Satya Nadella's remark in Cologne — that the episode underscores the need to build systems "that can be maintained securely" — points at exactly this. The problem is not that the flaws existed; all software has flaws. The problem is the growing mismatch between how much the world depends on this code and how little is invested in keeping it healthy.
Governments taking their own websites offline is also worth pausing on. It is a sign of maturity — institutions choosing temporary inconvenience over potential catastrophe. But it is also an admission: in 2026, the standard defensive playbook for critical infrastructure includes turning things off and hoping. That worked this week, partly because the flaws were found by the good guys first. Next time, the discoverers might not be.
And that is the real lesson of the PHP alert. The vulnerabilities will be patched, the attack numbers will fall, and the news cycle will move on. But the structural facts — AI accelerating discovery on both sides, exploitation windows measured in minutes, critical code maintained on goodwill — are not going away. This week was not an anomaly. It was a preview.
Frequently asked questions
Does this affect me if I don't run a website?
Indirectly, yes. The services you use — banking, government portals, airlines, online shops — run on PHP, and several temporarily shut down or restricted services this week as a precaution. If a site you use was compromised before patching, your account data could theoretically be at risk, which is why changing important passwords after a major disclosure is sensible hygiene.
How do I check which PHP version my site is running?
In most hosting control panels (cPanel, Plesk, or your host's dashboard), the PHP version is listed under the site settings or "Select PHP Version" page. If your site runs WordPress, go to Tools → Site Health → Info → Server in the admin panel. If you cannot find it, ask your hosting provider — they will know, and this week they have heard the question many times.
My hosting company hasn't patched yet — what should I do?
Contact them and ask directly when they will apply the PHP security updates, referencing the October 21 disclosure. If they cannot give you a date, consider it a serious red flag about that provider. In the meantime, enabling a web application firewall (WAF) — Cloudflare and others deployed rules for these flaws quickly — adds a layer of protection, but it is not a substitute for patching.
Is this worse than Log4Shell?
Not quite, but it is in the same league. Log4Shell (2021) was rated a perfect 10 out of 10 and drew more than 25 million hacking attempts, per CloudSEK's figures. The PHP flaws are rated 9.2 — extremely serious, but a notch below the worst ever seen. The similarity is in the pattern: a flaw in ubiquitous, foundational software, lurking for years, exploited at massive scale within hours of disclosure.
Will AI make incidents like this more common?
Probably — but on both sides. AI-assisted code analysis will find more hidden vulnerabilities, which means more emergency disclosures like this one. The same technology also helps defenders scan their own systems faster and deploy protections automatically. The net effect, as Palo Alto Networks put it, is an acceleration of the whole cycle: faster discovery, faster attacks, and an ever-greater premium on being patched before the announcement, not after it.
What if my site runs on an unsupported PHP version?
Then there is no official patch available for you, and this is the most dangerous position to be in. Your options are upgrading to a supported PHP branch, asking your host about extended-security backports, or migrating. Running an unpatched, unsupported version after a 9.2-severity disclosure is, frankly, leaving the front door open in a neighborhood where everyone now knows the address.
For more explainers on the technology shaping our world, visit abdulrahimmughal.com.