Government websites in Europe went offline on Wednesday, October 21, after PHP’s developers released fixes for two critical flaws found with the help of AI, Reuters reported. The Dutch National Cyber Security Centre took its own site down as a precaution, and organizations including the Port of Rotterdam and Overheid.nl followed. Finland’s state IT provider Valtori took government network services offline, and France’s Interior Ministry placed all of its websites into preventive maintenance, according to Reuters.
The bugs, tracked as CVE-2026-109618 and CVE-2026-109619, carry a CVSS score of 9.2 and affect PHP 5.4 through 8.5.11, Google Cloud said. Fixes ship in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP project is not releasing fixes for 8.1 or earlier. About 1.5 million of 2.6 million hosts report running a PHP version with no fix, Reuters reported, citing Censys data.
OpenAI said security firm Calif identified a critical flaw using GPT-5.6 Sol as part of its Patch the Planet initiative, and that it coordinated maintainers, researchers and government agencies, including CISA, ahead of disclosure. “To our knowledge, frontier AI found these vulnerabilities before attackers did,” OpenAI wrote. It released a PHP version checker as a Codex skill.
Wiz said it independently found the flaws using its Wiz Atlas tool, Google’s Gemini 4 Argon and GPT-5.6 Sol, and demonstrated unauthenticated remote code execution against WordPress, Drupal and Joomla. A single researcher using frontier models “completed in a week what previously would have taken a world-class team months of work,” Wiz wrote.
Amazon security chief CJ Moses said Amazon detected an exploitation attempt on a honeypot on October 17, four days before disclosure, and that the flaws were “now being broadly exploited in the wild,” according to Reuters. The White House said it learned of the flaw on Friday, Reuters reported.
Sources
- Reuters via Investing.com (Satter, Marchandon, Ghosh, Pardesi): Government websites go dark after AI-discovered flaw sparks security scramble (October 21, 2026; updated October 22)
- OpenAI: Patch the Planet: global response coordination as agents uncover critical vulnerabilities (October 21, 2026)
- Wiz Research: PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet (October 21, 2026)
- Google Cloud (Chris Betz): Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 (October 21, 2026)