A Tuesday Leak Burned a Two-Month Head Start. By Wednesday, Governments Were Taking Their Own Websites Down

On Tuesday, somebody posted it on social media.

The technical details of two critical vulnerabilities in PHP — the programming language quietly running an estimated 70% of the world’s websites — had been circulating for weeks inside a closed coalition of maintainers, security firms, and AI labs. The plan was a coordinated disclosure later in October, with fixes ready and protections in place. The leak torched the plan. By Wednesday afternoon the PHP Foundation was rushing out emergency patches, and by evening governments were taking their own websites offline rather than wait.

Start with what was sitting in the open for 14 years. The flaws, since nicknamed PHP2Shell and catalogued as CVE-2026-109618 and CVE-2026-109619, both score 9.2 out of 10 on the severity scale. Either one lets an attacker run code on a web server without logging in — a direct path to the server’s file system or database, in the NSA’s words. Every PHP release back to version 5.4 is hit by at least one of them. PHP says every installation serving web requests is at risk: PHP-FPM, Apache’s mod_php, php-cgi, FrankenPHP, LiteSpeed. Worst is mod_php, where researchers demonstrated an exploit firing from a single unauthenticated request before any application code runs at all. And the exposed memory can hold passwords, authentication tokens, API keys, and certificates, according to Wiz.

Fourteen years. The bug was partially noticed in 2024, but the full version surfaced only this August and September — and it surfaced three times, independently. A self-described hacker team called Calif found one flaw using GPT-5.6 Sol, OpenAI’s advanced model, as part of OpenAI’s “Patch the Planet” program, the open-source security initiative it launched in June with Trail of Bits. Wiz, the Google-owned cloud security firm, found and reported both flaws on its own. OpenAI’s own internal researcher found the issue around the same time, too. Three independent discoveries in about a month, after a decade and a half of nothing.

That triple discovery is what set the two-month clock running. OpenAI says it led a coalition of maintainers, researchers, and infrastructure providers through September and October to prepare fixes and protections before disclosure — the intricate fix required major changes to the PHP engine itself — with Wiz and Cloudflare contributing research and technical support. This was the plan working. The defenders had found it first. OpenAI called it the “defender’s window”: frontier AI locating an internet-scale flaw ahead of the attackers, buying time to prepare.

Then Tuesday’s leak.

The PHP Foundation had intended to announce later this month with a complete fix. Instead it spent Wednesday pushing emergency security updates into the open, and the world’s cyber agencies spent the day telling everyone to install them or pull the plug. The UK’s National Cyber Security Centre told organizations that couldn’t patch immediately to “consider taking the system offline until it can be fully mitigated.” The NSA issued similar advice on X. The White House said federal agencies were working with leading AI labs to speed up a fix. Japan’s prime minister, Sanae Takaichi, posted on X urging people to check whether their public websites ran PHP.

And then the roll call of the darkened. Finland temporarily shut down the government’s public web services. The Netherlands’ cybersecurity agency took its own website offline. So did the website of the Tweede Kamer, the lower house of the Dutch parliament, and the Dutch public-health institute. Edinburgh council’s site went inaccessible. Several BBC programme sites — Doctor Who, The Traitors — went dark, though the BBC hasn’t confirmed the link. The art platform DeviantArt posted that it was “temporarily down for maintenance.” The Wikimedia Foundation said it had taken down a number of systems as a precaution, and parts of Wikipedia became unreachable.

No single outlet has put that list together. Assembled, it reads like a census of what the modern web is actually built on — government portals, a parliament, a public-health agency, a city council, an encyclopedia — all sitting, knowingly or not, on the same fourteen-year-old foundation. As the security firm Huntress put it: PHP “quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn’t even advertise that it runs PHP under the hood.” A flaw in the language is a flaw in all of them at once. The 70% figure comes from Wiz and OpenAI; the BBC notes it can’t verify it. Even half of it would be the largest single-software exposure in recent memory.

Here is the part the coverage has mostly glossed over. In the same blog post where OpenAI called PHP2Shell “one of the most impactful security issues in recent memory,” it wrote the sentence that undoes the triumphalism: the discovery “highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits.” The defender’s window is real, and so is the other side of it. OpenAI is simultaneously announcing a $1 billion subsidy for access to Daybreak, its cybersecurity auditing platform for under-resourced organizations, and releasing a Codex skill on GitHub that checks whether a site has been compromised — while conceding that the models doing the finding will do the attacking just as well. “We expect similar findings to increase sharply in the coming months,” the company said. Read that as a forecast, not a boast.

The window is already narrowing. Dane Knecht, Cloudflare’s chief technology officer, said his company is “seeing early attacks emerging and are updating mitigations as new vectors show up.” The patches exist. The exploits are being written. Somewhere in between, administrators are hunting down every instance of a language that hides inside content management systems, hosting panels, and third-party products — “sometimes without even being obvious to the organisation using it,” as Sophos researcher Don Smith told the BBC — and checking whether an attacker already has a foothold.

The coalition did nearly everything right. It found the bug first, built the fix quietly, and held the line for two months. It lost to a post on social media on a Tuesday. The emergency that followed — parliaments offline, prime ministers posting warnings, an encyclopedia dark in places — is what the end of the defender’s window looks like when the attackers get the same tools.