Critical PHP2Shell Flaw Forces Government and Commercial Sites Offline

PHP, created in the 1990s and used by just under 70% of websites with known server-side programming languages, was found in mid-August to contain two vulnerabilities that together allow unauthenticated remote code execution on PHP servers, according to CNBC. The flaws were rated 9.2 out of 10 for severity. Researchers at AI firm Calif used OpenAI's GPT-5.6 Sol to find them, while Google's Wiz team used its Wiz Atlas security AI agent, Google's Gemini 4 Argon and GPT-5.6 Sol, CNBC reported.

The PHP Foundation had planned to release patches on Thursday, but disclosure was embargoed until this week and leaked two days early; Calif accidentally posted a proof-of-concept video on Tuesday, CNBC reported. The foundation released patches 24 hours early at 10 a.m. ET on Wednesday, shortly after the NSA warning. 9to5Mac reported that AI models and a cybersecurity researcher discovered the flaw simultaneously in mid-August and that Amazon Web Services said the vulnerabilities were being broadly exploited.

TechRadar reported that the Wikimedia Foundation took some services offline to patch, including Toolforge and Cloud VPS, and warned of outages for its wikis. The Internet Archive was offline on Oct. 21; founder Brewster Kahle called operations staff heroes for limiting damage, though the outlet said the outage was not definitively linked to PHP. Orange temporarily suspended access to several websites and apps that use PHP across dozens of countries, calling it a precautionary measure and apologizing for inconvenience.

Several BBC news pages, 4chan, Pinboard, Miraheze and OpenStreetMap went offline or restricted operations, TechRadar reported. Nintendo, Asana, Duolingo and GOG paused operations without mentioning PHP, and games including Pokémon Sleep, Umamusume: Pretty Derby, Granblue Fantasy and Princess Connect! Re:Dive also went offline. In the UK, a minister said 32 government services were offline, and a spokesperson said work had begun with OpenAI and the National Cyber Security Centre to fix vulnerabilities in government systems, according to TechRadar. The Office for Budget Responsibility took its website offline on Oct. 21 before restoring it the next day. Local council sites for Edinburgh, Oxfordshire and Hillingdon also went offline.

European government and commercial sites were affected. TechRadar listed Belgium's Foreign Ministry, the Czech national government website, Denmark's municipal IT company Kombit, Finnish public government service sites, French prefecture sites run by the Interior Ministry, Germany's federal IT provider ITZBund, the Dutch National Cyber Security Centre, the Port of Rotterdam, Overheid.nl, the KNVB football association, the websites of the five largest Dutch political parties and many national hospitals.

The NSA advised unpatched sites to go offline until fixed, and the UK National Cyber Security Centre told organizations to identify PHP use and update quickly or consider taking systems offline, according to TechRadar. The PHP Foundation told CNBC it was monitoring the situation and had no evidence of working exploits, only incomplete, misguided and non-working generated ones. Matt Suiche, a researcher at Tolmo, said his team coded a working exploit in less than a day, and Amazon Threat Intelligence reported identifying a PHP2Shell exploit attempt on Saturday on its MadPot network.

CNBC reported that the PHP Foundation acknowledged in a blog post Wednesday that a two-year delay in fixing a related root-cause flaw was a structural failure caused by the security team's decision process and lack of resources. Mihail Kirov, then at Quarkslab and now at Tolmo, said he was part of a team that found the same root-cause vulnerability two years ago and the foundation was alerted but no fix was rolled out. Experts told CNBC that organizations may never know whether data was breached unless they had application security monitoring in place or the data later appeared for sale on the dark web.