AI found two critical holes in PHP, and Denmark took Aula offline. Finding bugs is now the easy part.
Two critical flaws in PHP, the language behind roughly 70% of websites, were found with AI models from OpenAI and Google, and patched on 21 October. In Denmark, Aula and DMI went offline as a precaution. The finding took weeks. The patching is now the slow part, and it is every website owner's job.
The PHP project released emergency patches on Wednesday 21 October for two critical flaws that let an attacker run code on almost any server running PHP, without logging in. The flaws, CVE-2026-109618 and CVE-2026-109619, were found with AI models. Wiz, the cloud security firm owned by Google, explains in its write-up of “PHP2Shell” that it used its own Wiz Atlas agent together with Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol, and that every PHP version from the past decade is affected by at least one of the bugs. In Denmark, Kombit took Aula, the school and daycare communication platform, offline the same afternoon, and DMI closed parts of its website, Ritzau reports.
How serious the PHP2Shell flaws are
Each flaw scores 9.2 out of 10 on the CVSS v4 severity scale, TNW reports, and both are memory-safety bugs in how PHP cleans up after fatal errors. Wiz showed working attacks without authentication against WordPress, Drupal and Joomla, and says even a “Hello World” page on an affected PHP version can be vulnerable, because the bug sits below the application code. One of the flaws can also leak server memory, which means passwords, tokens and API keys, without the attacker getting as far as running code.
PHP runs roughly 70% of websites with a known server-side language, according to W3Techs figures cited by TechCrunch. That number is about PHP’s reach, not the count of exposed sites. A better estimate of exposure is the 22.6 million potentially vulnerable instances in Palo Alto Networks’ first analysis, which Fortune reports. Volker Dusch of the PHP Foundation called it the worst issue PHP has faced in more than a decade, according to TNW.
The patched versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP project also released fixes for the unsupported 7.4, 8.0 and 8.1 branches. PHP says updating is the only safe choice, because no configuration change fully protects a server.
Why Aula and DMI went offline in Denmark
Danish organisations that could not patch at once followed the official advice and pulled systems off the internet. Styrelsen for Samfundssikkerhed told system owners to update as quickly as possible or take their systems offline, TV2 Østjylland reports. Kombit closed Aula and the municipal library system on Wednesday afternoon, citing a potential security risk in an underlying component, and confirmed to Ritzau that the risk was related to PHP.
Aula was still closed on Wednesday evening, and Assens Municipality asked parents to send notes in their children’s school bags if it stayed down on Thursday, TV2 Fyn reports. Closing a site is a precaution, not proof of a breach, and nothing so far suggests Aula was compromised.
Denmark was not alone. Fortune, citing Reuters, reports that agencies in the Netherlands and Finland took websites offline, and Ritzau adds Norway, France and Germany. CERT-EU and Britain’s NCSC told organisations to go offline if they could not patch, and the US National Security Agency and FBI issued their own warnings. Jeppe Engell of Dansk Industri was blunter: every company and authority running PHP on the internet should update now, he told Ritzau, “not tomorrow”.
How AI found a bug that had been hidden for over a decade
Two teams found the flaws independently, both with AI. Fortune reports that Calif, a California security firm working under OpenAI’s Patch the Planet programme for open-source code, found the first issue on 1 August using GPT-5.6 Sol. Wiz found its first bug on 19 August and confirmed unauthenticated attacks on Drupal and WordPress within two days. It reported to the PHP security team on 24 August. PHP acknowledged the reports on 21 September and shipped the fix on 21 October, 58 days after Wiz’s report.
The disclosure did not go to plan. TNW reports that details leaked in a Hacker News post, PHP moved its release forward, and a proof-of-concept exploit circulated soon after. Cloudflare’s chief technology officer told Fortune that early attacks began before the official patch was out. Cloudflare had switched on firewall rules for all customers, free accounts included, about nine hours before disclosure, and saw attackers change their payloads to get past them.
The AI story is real, but it is easy to overstate. Calif said it used only generally available models and no special tools, and that knowing PHP’s history mattered more than the model, according to TNW. No model finds every bug from a simple prompt. OpenAI calls this period a “Defender’s Window”, in which AI finds flaws before criminals do, and expects many more such findings in the coming months. Wiz makes the less comfortable point: AI made it much cheaper to turn these bugs into working exploits for different PHP versions and server setups.
Both claims can be true at once. Anthropic made the same argument in April, when it held back Claude Mythos Preview because it found vulnerabilities too well. PHP2Shell is what that looks like in practice: weeks to find, two months to fix, and a few hours for attackers to start once details leak.
What a European business should do this week
Find out whether you run PHP, and where. That includes the company website, the webshop, the intranet, the booking system a supplier hosts for you and the old campaign site nobody has touched since 2021. WordPress, Drupal, Joomla, Magento and many customer portals run on PHP. If you do not know the answer within a day, that is the first finding.
Patch, or take it offline. The official Danish advice is unusually clear, and it applies to private companies too. If the site sits with a hosting provider or an agency, ask in writing when it was updated and to which version. Shared hosting customers depend entirely on the host here.
Assume secrets may have leaked from anything that was exposed before patching. Because one flaw can read server memory, rotate database passwords, API keys and session secrets on public-facing PHP systems, and check logs for the signs Wiz lists: unusual multipart requests followed by memory-limit errors, repeated HTTP 500 responses and oversized session cookies.
Put a patch deadline in your contracts. This is the second time in a few months that AI-found flaws have forced a mass update of web software, and AI attack tools are already in criminal hands. Companies covered by NIS2 already have to handle vulnerabilities; everyone else should at least know how fast their web agency or host must apply a critical patch, and who decides to pull a site when it cannot.
The AI models needed a few weeks to find PHP2Shell. The 22.6 million exposed instances will be fixed one owner at a time, and some of them never will be.
