Two critical flaws in PHP, the programming language that powers about 70 percent of the world’s websites, were patched in an emergency release on October 21. But the attackers did not wait for the announcement. Amazon says one of its decoy servers recorded an attempt to exploit the flaws, collectively known as PHP2Shell, on October 17, four days before the patch went public. Governments pulled sites offline as a precaution while agencies told every operator to update immediately, and the flaws are now being widely exploited.
What PHP2Shell actually is
PHP2Shell is the name researchers gave to two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10 for severity. In plain terms, they let an attacker run malicious code on a web server without logging in, and read sensitive data from the server’s memory, such as passwords. CrowdStrike summed up the danger: there is no authentication to bypass, no session to steal and no vulnerable endpoint to discover. The Drupal Association warned that every PHP release of the last 20 years is vulnerable, and the Wordfence security team noted that all WordPress sites run on a PHP-installed server, which means ordinary automatic updates do not apply this fix.
Meanwhile, the NCCIA’s arrest of 1,129 cybercriminals in a month shows Pakistan’s own cybercrime enforcement is active.
Security firm Calif found them in August using OpenAI’s GPT-5.6 Sol model during an OpenAI-funded audit; OpenAI’s own team and Google-owned Wiz found them independently in September. A security engineer with the PHP Foundation, Volker Dusch, called it the most serious problem PHP has faced in more than a decade and compared it to Heartbleed, the 2014 flaw that forced a worldwide patching rush.
The attackers got a four-day head start
The most alarming part of this episode is the timeline, compiled by PakMirror from the researchers’ own disclosures. In August, the flaws were found and kept secret while a fix was built. On October 17, Amazon’s MadPot honeypot logged an attempt to exploit the flaws from an anonymised IP address. Amazon’s security chief CJ Moses said the timing suggests a threat actor was probing the bug under embargo. On October 20, PHP posted an advance notice of the fix. Then details leaked online a day early, and exploit code appeared within hours of the patches going live on October 21.
Amazon now says PHP2Shell is being broadly exploited in the wild by multiple sources. Cloudflare’s chief executive Matthew Prince described the surge: thousands of attempts in the ten hours before the announcement, tens of thousands in the 45 minutes after it, hundreds of thousands within two hours, and millions by now. Costin Raiu of TLP:Black warned of an AI-powered “race to exploit” and predicted the “mass compromise of every vulnerable web server on the internet.”
The shutdowns: from The Hague to Paris
Faced with that surge, governments chose caution. Agencies in the Netherlands and Finland took websites offline before the fix arrived, and the Dutch national cybersecurity agency pulled its own site down as a precaution. The UK’s National Cyber Security Centre advised organisations that could not patch immediately to take systems offline, while the US National Security Agency and the FBI’s cyber division told operators to patch immediately or pull vulnerable systems offline. In France, local government websites including the Paris police prefecture went inaccessible at the request of the national cybersecurity agency, and some large services including Wikipedia and the Steam store were also briefly offline.
What happens next, and what Pakistani website owners must do now
The instruction from every authority is the same: patch now. The PHP team released fixed versions, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the foundation told operators that updating was imperative. Datadog’s researchers warn that only patching fixes these flaws; community workarounds do not fully protect a server.
Pakistan is squarely in the risk zone. TechJuice reports that many Pakistani government portals, banking platforms and e-commerce sites run on PHP or WordPress and urges organisations to patch, while noting no confirmed attacks have been reported so far. Any website running PHP on its own server is exposed, from a ministry portal to a small business site. And the lesson is clear: AI found this flaw in hours and can reverse-engineer a public patch into a working attack just as fast, and 2026 is already on track to roughly double last year’s record for discovered software vulnerabilities. This time the good guys found the bug first and the world got two months of warning.
The timing is striking: Pakistan is moving ahead with the world’s first digital and AI compact, even as this episode shows AI cuts both ways.
PakMirror will keep tracking patches and fallout in our latest technology news from Pakistan.
