Banks, airlines, and agencies take services offline as unauthenticated code-execution flaws draw millions of attempted attacks before fixe arrive

On 22 October 2026, banks, airlines, and government agencies took websites and services offline on as they rushed to patch PHP2Shell, the name given to two critical vulnerabilities in PHP, the programming language behind much of the web.

The bugs, tracked as CVE-2026-109618 and CVE-2026-109619, are each rated 9.2 out of 10. They allow attackers to execute code on a server without authentication and affect PHP versions dating back to 5.4. Fixes are available in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

The patches had already been scheduled for 22 October 2026, but as details were leaked online on 20 October 2026, PHP had been prompted to release them early. The PHP Foundation said researchers at Calif also “mistakenly published a video” demonstrating how the flaws could be exploited. Although the video was removed, it had spread through hacking forums.

According to an Amazon source, its sensor network had detected exploitation attempts before the vulnerabilities were even publicly disclosed. The firm said it remains unclear how attackers learned of them. The US National Security Agency has advised organizations to take systems offline if they could not update immediately, and agencies in Singapore, the UK, Australia, Canada, and the European Union have issued comparable warnings. Also:

Sources claim that AI had played a role in the discovery of the flaws:

  • Calif had found them using OpenAI’s GPT-5.6 Sol
  • Google’s Wiz unit had independently identified them using Gemini 4 Argon and GPT-5.6 Sol
  • The PHP Foundation said it scanned had PHP earlier this year with Anthropic’s Claude Mythos and thanked the firm for access to its tools, but credited Calif, OpenAI, and Wiz with reporting the vulnerabilities.

Ryan Austin, the Calif researcher who helped uncover the bugs, described them as “the most serious vulnerability” he had ever found, adding that “it doesn’t look like exploitation has taken off or been widespread.” According to BBC News, thousands” of exploitation attempts were disclosed in the 10 hours before the flaws were disclosed, rising to “hundreds of thousands within two hours, and millions now.” No successful attack has been reported so far.