PHP & Railway Security Crisis: The Internet Is Under Attack!

I recently checked around 80 websites, including Pakistani government websites, and what I discovered was alarming.

More than half appeared to be running outdated PHP versions.

And we are not talking about random personal blogs. Some of these are government websites.

Now imagine what could happen if attackers managed to gain access to the systems behind them.

Yes, an older PHP version does not automatically mean a website is vulnerable. Some servers receive security patches without changing their visible version numbers.

But after what happened on October 21, 2026, ignoring these warning signs is not an option.

Two major security incidents. Almost at the same time. One involving PHP, a technology powering a massive part of the internet. The other involving Railway, a platform used to host modern applications.

And here's the frightening part: One of these vulnerabilities had been hiding in PHP for years. AI helped researchers uncover what humans had struggled to find.

We are spending so much time building new websites with AI, but are we even securing the websites we already have?

Let me explain exactly what happened, why it matters, and how to protect your website. In very simple English.

First, what is PHP?

PHP is a server-side programming language that has existed for more than 30 years.

Think about a restaurant.

You sit at the table, look at the menu and place an order. That is what you see on a website.

But behind the kitchen door, someone receives your order, prepares everything and sends the result back.

That is what server-side programming does.

PHP helps websites process forms, manage accounts, communicate with databases and perform many other tasks.

WordPress, Joomla, Drupal and millions of custom websites use PHP.

According to W3Techs, PHP powers approximately 69% of websites whose server-side programming language is known.

So yes, while everyone is busy building fancy AI websites, a huge part of the internet is still running on PHP.

And PHP itself is not the problem. The problem is an important security flaw discovered inside it.

See content credentials

What actually happened?

Researchers discovered two critical vulnerabilities, now called PHP2Shell.

Their technical names are CVE-2026–109618 and CVE-2026–109619.

Both received security severity scores of 9.2 out of 10.

Let me explain the actual bug.

Imagine a school office where a worker handles student records.

After finishing one student's work, the worker throws away the old paper but accidentally keeps a note pointing to where that paper was stored.

Now imagine another person manages to put different information in that same place.

The worker may trust that information because the old note still points there.

Something similar can happen inside PHP's memory.

When PHP experiences certain errors, it can leave behind damaged or outdated internal information. An attacker may manipulate this situation and cause PHP to treat the wrong information as valid.

Under vulnerable conditions, this can allow someone to run commands on the website's server.

This is called Remote Code Execution.

And the scary part?

In some cases, the attacker does not even need a username or password.

If an attack succeeds, depending on the server's permissions, criminals could steal data, change website content, install malicious software or disrupt services.

The weakness had existed in parts of PHP for many years. Finding and exploiting it was extremely difficult.

Then AI entered the picture.

AI changed the game

Researchers used advanced AI models, including GPT-5.6 Sol and Gemini 4 Argon, to help discover and investigate these weaknesses.

Problems that could take human researchers enormous effort became easier to analyse with AI assistance.

OpenAI and security researchers helped coordinate with PHP maintainers so fixes could be prepared.

But after the vulnerabilities became public, attackers started trying their luck.

Cloudflare's CEO reported that exploitation attempts across its network increased from thousands to millions within hours.

Remember, millions of attempts do not mean millions of successful hacks.

But they do show how quickly attackers react.

We have been teaching AI to write code. Now it can also help us find very complicated mistakes in that code.

Very impressive technology.

Unfortunately, hackers also have internet connections.

Then Railway had its own security incident

Railway is a cloud platform used by developers to deploy and run websites, applications and their back-end services.

It is particularly useful for people creating modern web applications, including AI-powered applications.

Imagine you build an AI chatbot.

Your application needs a private API key to communicate with an AI provider.

Think of that API key like a paid membership card.

Anyone holding the valid card may be able to use the connected service, depending on its permissions.

Railway stores secrets such as these in environment variables.

During a security breach, an unauthorized party accessed some internal Railway systems and potentially obtained decrypted customer secrets.

Railway's preliminary investigation estimated that at most 1.85% of its workspaces had environment variables potentially compromised.

That is still around 100,000 workspaces.

Not every Railway application was compromised, but the risk was serious enough for Railway to recommend changing stored credentials.

A stolen API key could allow unauthorized usage, unexpected charges or access to connected systems.

This incident was separate from PHP2Shell.

Why should Pakistan take this seriously?

Because websites are not just company brochures anymore.

Government portals, universities, hospitals, businesses and financial services depend on online systems.

A compromised government website could expose citizen information. A compromised university portal could affect student records. An online store could lose access to customer or payment-related systems.

And we have another problem.

Many organizations build websites and then forget about maintenance.

A website can look beautiful and work perfectly while its server is running outdated software.

A working website is not necessarily a secure website.

Pakistan's National CERT has already published an official warning about these PHP vulnerabilities.

This is not just another social media security rumour.

Here is what you should do, step by step

Step 1 — Check your PHP version.

If you use WordPress, go to Tools → Site Health → Info → Server and look for your PHP version. You can also check your hosting control panel, such as cPanel, or ask your hosting provider.

Step 2 — Check whether it has the security fix.

The emergency patched versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. If you have an older release, ask your provider whether a verified security patch has been installed. PHP 8.1 and older are unsupported by the main PHP project.

Step 3 — Update the server safely.

Back up your website and database. Ask your developer or hosting company to install the appropriate PHP security update and test the site afterward.

Updating WordPress plugins alone will not fix this PHP problem.

Step 4 — Review security activity.

Ask your technical team to check server logs, unknown administrator accounts, unusual files and suspicious activity. Enable appropriate firewall protection, but remember that a firewall does not replace the PHP update.

Step 5 — If you use Railway, change your keys.

Revoke old API keys and database credentials, generate new ones, update Railway's environment variables and redeploy affected services. Review access logs and API billing for unusual usage.

Step 6 — If you cannot patch immediately, restrict access.

Ask your hosting provider to isolate vulnerable services until they can be secured. If you suspect a breach, preserve evidence and report it to the relevant security team or Pakistan's National CERT.

Step 7 — Make someone responsible for updates.

Security is not something you check only when a viral post scares everyone. Assign someone to review website updates, backups and security alerts regularly.

My final thought

AI is not automatically destroying the internet.

In this case, AI also helped defenders discover dangerous vulnerabilities and develop protections.

But AI is changing the speed of cybersecurity.

The time between finding a weakness and someone trying to exploit it can be frighteningly short.

My advice is simple: Don't panic. Check your website. Update it. Secure your keys.

And please, if you are running an important website, don't wait for a hacker to become your unpaid security auditor.

That lesson can become very expensive.