What happened when AI found a decade-old hole under 70% of the web?

Wednesday, 21 October 2026. For most people it was an ordinary working day. Then, one after another, government websites in France, Denmark, Finland and the Netherlands went dark. Even the site of the Dutch cyber security agency disappeared behind a maintenance page. Across the Atlantic, Canadian federal sites followed. Nobody had broken in. Their own operators had switched them off, racing to patch two critical flaws in PHP, the language that runs about 70% of the web. The flaws had been hiding for more than a decade, until frontier AI models helped researchers find them. If you write software for a living, this is a week worth slowing down for.

The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and security firms call them PHP2Shell. Both are rated 9.2 on the CVSS v4.0 scale, which counts as critical (Quartz). They are memory safety bugs in how PHP cleans up after a fatal error, especially an out of memory error. A crashed request can leave stale internal state behind, and a later request can reuse it (Wiz Research).

What makes them unusual is where they live. The bugs sit in PHP itself, below the application. Wiz showed unauthenticated remote code execution on the latest WordPress, Drupal and Joomla container images, and showed that attackers could read passwords, tokens and API keys from server memory without taking over the server at all. Every PHP release of the last decade is affected by at least one of the bugs, going back to version 5.4 (Wiz Research).

The timeline, as the researchers and responders have published it:

timeline
    title PHP2Shell, from discovery to patch (2026)
    19 Aug : Wiz finds the first flaw with AI assistance
    20-21 Aug : Remote code execution confirmed on Drupal, then WordPress
    24 Aug : Flaws reported to the PHP security team
    21 Sep : PHP acknowledges and starts a coordinated fix
    20 Oct : PHP announces a critical release for the next day
    21 Oct : Patches ship at 14:00 UTC, NSA issues guidance, sites go offline

Wiz used its own Wiz Atlas tool together with Gemini 4 Argon and GPT-5.6 Sol. Its researchers wrote that a single person with frontier models finished in a week what would once have taken a world class team months (Wiz Research). Separately, Ryan Austin of the security firm Calif found the same class of bug while auditing PHP under OpenAI's "Patch the Planet" initiative (Forkast).

The disclosure did not stay quiet. Technical details leaked before the planned release (Recorded Future). PHP announced on 20 October that fixes would ship the next day at 14:00 UTC, and that it might release earlier if details went public (PHP Foundation). The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (Quartz). The same day, the NSA told organisations that could not update right away to take the affected system offline until it was mitigated (SecureWorld).

Many did exactly that. Government sites in France, Denmark, Finland and the Netherlands went dark for a while, including the website of the Dutch cyber security agency itself, and the Irish news site The Journal went offline to strengthen its defences (ABC7). Canada's AI minister said some federal sites were taken down as a precaution (CBC).

None of this is entirely new, and the researchers who found PHP2Shell say so themselves. Wiz compares it to two earlier turning points: Heartbleed in 2014, which showed how fragile the shared code securing the internet was, and Log4Shell in 2021, which showed how deeply one dependency can hide inside everything (Wiz Research).

The closest echo is Log4Shell. It was disclosed on 9 December 2021 with the maximum severity score of 10 (ITPro). Within days, Quebec shut down nearly 4,000 of its government sites as a precaution (Security Affairs). Five years later, governments made the same choice for the same reason.

AI finding real bugs is not new either. In 2024, Google's Big Sleep agent found an exploitable memory safety bug in SQLite. The developers fixed it the same day, before it reached an official release, so no user was ever exposed (Google Project Zero). The difference this time is age and reach. Big Sleep caught a fresh bug in code that had not shipped. PHP2Shell was a decade old, already running on most of the web, and its exploit leaked before every server could be patched.

Everyone running PHP had to act, even those whose own code was clean. For website owners and small businesses on WordPress, Drupal or Joomla, that meant patching the same day. Malwarebytes notes that PHP 8.1 and older no longer get routine security updates, which leaves abandoned sites and forgotten admin panels as the long tail (Malwarebytes). Governments chose a few hours of downtime over the risk of a breach. In the Netherlands even DigiD, the national login service, went offline (Isatis).

Most everyday users never saw an attack. They saw a maintenance page. Their real exposure is quieter, because the memory disclosure bug could leak passwords and session tokens without leaving much trace (Wiz Research).

Behind those maintenance pages, a lot of people worked late. On release day the PHP Foundation warned that a volunteer run package repository might not update in time, then reported that its maintainer, Remi, signed and shipped the packages anyway (PHP Foundation on X). Before disclosure, Wiz had worked with Google Cloud, Cloudflare, AWS, Microsoft, Fastly, Akamai, Vercel and others to prepare protections for customers who could not patch at once (Wiz Research).

For AI labs and the people building AI tools for developers, this week was a public demonstration of both sides of the same capability. The models that helped find and exploit the flaws also helped detect attacks and verify the fix.

I do not want to predict what this means or where it takes us, so I will stay with what we already know. PHP started in the 1990s as a small tool for personal web pages and grew into the foundation of most of the web. Nobody planned that. It grew fast because it was easy to use, and every year of growth added code that would be hard to change later. Wiz traces PHP2Shell back to architecture decisions made more than a decade ago (Wiz Research).

That is the trade every new technology makes. You move fast because the thing you are building did not exist before, and nobody knows yet which corners matter. Some of those corners turn into incidents years later. The same is true of AI right now. It is new, it is moving fast, and it just showed it can both expose an old risk and help close it.

Working at a cybersecurity company made me conservative about the technology I choose, and secure by design has always been my first choice. That work also taught me that security is never finished. A system that is safe today, with exactly the same configuration, can be vulnerable tomorrow because something changed somewhere else. PHP2Shell is one example: the old code stayed the same, but AI made its flaws practical to exploit. Encryption is another. Most of what protects us online rests on math problems that today's computers cannot solve in any useful time, yet a capable enough quantum computer could solve them quickly. That is why NIST published its first three post-quantum encryption standards in August 2024, so organisations can start switching before such a machine is built (NIST).

History is full of people who used a bad moment to make things stronger.

• After Heartbleed (2014). OpenSSL, which secured a large share of internet servers, had very little funding. Within weeks, the Linux Foundation launched the Core Infrastructure Initiative, backed by Amazon, Google, Microsoft, Intel and others. Its first act was paying two full time OpenSSL developers (Linux Foundation).
• After Log4Shell (2021). The White House brought software companies and open source foundations together in January 2022. By May they had a 10 point plan, an estimated $150 million over two years, and about $30 million already pledged (MeriTalk).

This week already has its own small version of that pattern. The PHP team announced the release a day ahead so people could prepare. Cloud providers shipped protections before the details were public. A volunteer signed packages through the night. People showed up.

This special edition steps outside the usual schedule, but it asks the same question as the rest of Space Native Engineering: what happens to engineering when space becomes an ordinary place to run software? On a satellite or a lunar base, you cannot always switch a system off and patch it over lunch.

There will be more weeks like this one. Old code will meet new tools, and something will break that nobody expected. That is not a reason to slow down. It is a reason to build with the lessons we keep paying for: fund the shared foundations, find the bugs before attackers do, and design for the day something fails. That is how we will reach space too: one hard lesson at a time, each one leaving the foundations stronger.

This is only the start for me, and I plan to keep writing here for the long haul. I am also close to sharing something I am excited about, so check back in a few days.