The Bug That Hid in 70% of the Web for 10+ Years, and How AI Found It

On October 21, 2026, websites around the world started showing "maintenance mode" pages. Government, school, and hospital sites in Europe went offline on purpose, and companies like Nintendo took some services down too.

The reason was not a hack of "the internet". It was two critical bugs in PHP, the software that runs behind a huge part of the web. Together they are called PHP2Shell, and they had been sitting in PHP's code for more than ten years. AI helped find them.

First, what is PHP?

PHP is a programming language that runs on web servers. When you open a website, PHP is often the part that takes your request, talks to the database, and builds the page you see. WordPress, Drupal, and Joomla all run on it. Wiz Research says PHP powers about 70% of websites.

Think of a website as a hotel:

• You are the guest walking in.
• The hotel's rooms are the website's data: accounts, orders, passwords.
• PHP is the receptionist. Every guest goes through the front desk first. The receptionist reads your request, checks the register, and sends you where you need to go.

The website owner hires the receptionist, but does not train them. PHP comes ready-made. So if the receptionist has a bad habit, every hotel that uses them has the same problem. That is why this news is so big: the bug is in PHP itself, not in one website's code.

The receptionist's two bad habits

Bad habit 1: Panicking when the desk is full

When PHP runs out of memory, it stops what it is doing immediately. Sometimes it stops while a guest's form is only half filled in. Later, during clean-up, PHP treats that half-filled form as if it were complete and correct. An attacker can send a specially built upload request that pushes PHP into exactly this situation. On servers using Apache with mod_php, this can happen before the website's own code even runs.

Bad habit 2: Not taking the old key back

PHP keeps some notes from one guest's visit after that guest has left and their space has been cleared. If the next guest is served by the same worker, PHP can use those stale notes before resetting them. It is like a hotel where the last guest's room key still opens the door for the next person.

Why it matters

By using these habits, an attacker can make the server run their own commands. No username or password is needed. Wiz also says attackers could read passwords, tokens, and API keys from PHP's memory.

The PHP security team rated both bugs 9.2 out of 10 (CVSS v4.0, "critical"). A score of 10.0 went around on social media before the release; the PHP Foundation says that number was incorrect.

Hidden for over a decade, found with AI

Every PHP version from 5.4 up to 8.5.11 is affected. Wiz says every PHP version released in the past decade carries at least one of the two bugs, and they survived years of manual security reviews.

So why now? Two teams found the problem using AI:

• Calif: researcher Ryan Austin used OpenAI's GPT-5.6 Sol during an August 2026 audit of PHP's source code. The audit was funded by OpenAI under its "Patch the Planet" programme, which pairs AI models with human security experts to find and fix bugs in open-source software.
• Wiz Research independently found and reported both bugs, also with help from AI models. Wiz says proving the bugs could actually be exploited needed a chain of steps so complex it sat at the edge of what human researchers could practically do.

Volker Dusch, a security engineer at the nonprofit that oversees PHP, called it the worst security problem the project has faced in more than ten years and compared it to Heartbleed, according to The Wall Street Journal.

The important point: AI did not create these bugs. They were already there. AI helped security researchers find them, so PHP could build a fix.

What happened this week

The plan was a quiet, coordinated fix. Instead, the bug IDs leaked a day early and attackers started probing.

The EU, the US, Germany, Japan, Australia, the UK and the Netherlands all issued local warnings, according to The Record.

What you should do

If you run a website on PHP

• Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. If you install PHP through your operating system's package manager, apply your vendor's updated packages (UW-IT).
• On older branches: PHP released minimal source backports for 7.4, 8.0, and 8.1 (Help Net Security). watchTowr notes there are no patches for PHP 5 or 7 overall (watchTowr).
• On shared hosting, ask your provider to confirm the fix is installed, not just scheduled (Malwarebytes).
• If you take a site down while patching, Google's John Mueller advises returning HTTP 503 rather than letting pages time out or return 404/500 (Search Engine Roundtable).

If your site is behind Cloudflare

Cloudflare's CTO Dane Knecht said PHP sites behind Cloudflare already have an initial set of firewall (WAF) rules for the known exploit paths, on every plan including Free (Help Net Security). Keep those rules on, but they are an extra layer only. Because the bug lives in PHP itself, you still have to update PHP.

If you are just browsing

The fix is applied on web servers, not on your phone or laptop. Some sites may stay in maintenance mode for a while as their teams patch (Malwarebytes).

The lesson for testers: test the failure path

Look at where both bugs lived. Not in login, search, or checkout. They lived in what PHP does when things go wrong: running out of memory, hitting a fatal error, cleaning up between requests.

Most test suites are built around the happy path. We check that the right input gives the right output. Far fewer tests ask:

• What happens when the server runs out of memory halfway through a request?
• What state is left behind after a crash, and does the next request see it?
• What does the system do with a huge or oddly formatted upload?

That is exactly the kind of corner where this bug hid for over a decade. Wiz says AI models lowered the barrier to proving bugs like this are exploitable, so these corners deserve more of our testing time, not less.

One small step this week: add one "what if it breaks halfway?" test to your suite.

Myths vs facts

If you want to stay updated on tech & AI updates, follow me on other platforms:

Anshita Bhasin Instagram | LinkedIn | Twitter | Youtube