On Wednesday, a programming language most Americans have never heard of briefly became the most important piece of software in the world. The volunteers who maintain PHP, the code that assembles web pages on servers across the internet, released emergency fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619, which security researchers have nicknamed “php2shell.” Within hours, governments on two continents were taking their own websites offline rather than risk having them seized.
The episode is a technology story, but it is also a story about government, responsibility, and the quiet public goods a free society depends on. It deserves a sober look before the next one arrives.
What happened
The Cybersecurity and Infrastructure Security Agency (CISA) said in its October 21 alert that the flaws “allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests.” In plain English, an attacker who never logs in can make a vulnerable server run commands of the attacker’s choosing. CISA urged organizations to update immediately to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, and said those that cannot, or that still run PHP 8.1 or earlier, “should take PHP-based systems offline until they can be patched or updated.”
The European Union’s cybersecurity body, CERT-EU, rated one of the two flaws at 9.2 on the 10-point CVSS severity scale and reported that the fixes went out at 13:30 UTC on Wednesday.
The scale is what made the world sit up. NBC News, citing the web-technology tracker W3Techs, reported that PHP is used in 69% of all websites; Reuters, citing the same tracker, put the figure at roughly 75% of sites whose programming language can be identified. Censys, an internet-scanning firm, told NBC that nearly 55 million web properties were running PHP as of Wednesday. Reuters reported Censys data showing that about 1.5 million of 2.6 million hosts it examined report running a version of PHP for which there is no fix. “All servers using any version of PHP released in the last 20 years will be vulnerable,” Tiffany Farriss, interim chief executive of the Drupal Association, told Reuters. “This issue impacts the majority of the internet.”
A day of dark websites
The response was swift and, in places, dramatic. Reuters reported that the Dutch national cybersecurity agency took itself offline as a precaution, and that the Port of Rotterdam, the government portal Overheid.nl, the websites of the Netherlands’ five largest political parties, and several hospital sites followed. Finland’s state IT provider, Valtori, took government public network services offline “as a precautionary measure,” and France’s Interior Ministry put all of its websites into preventive maintenance.
Here at home, NBC News reported that the FBI, the National Security Agency, and CISA all issued warnings. The Associated Press reported that the FBI’s cyber division recommended that operators take websites offline if they cannot update them immediately. According to Reuters, the White House said it was made aware of the flaw on Friday.
Whether attackers got there first is still being sorted out. CISA said it had “not observed exploitation of these vulnerabilities as of the time of publication.” But Amazon security chief CJ Moses wrote that his team detected an attempt to exploit the flaws against one of its decoy systems on October 17, four days before public disclosure, and Amazon later said the flaws were “now being broadly exploited in the wild,” Reuters reported. Cloudflare’s chief technology officer wrote on X, “We are seeing early attacks emerging and are updating mitigations as new vectors show up,” according to NBC.
Found by machines, raced by machines
The most striking detail is how the flaws were found. Reuters reported that two cybersecurity companies, Calif and the Alphabet-owned Wiz, said in independent reports that they discovered the problem with the help of artificial intelligence. Calif said it found the flaws with a large language model on August 1. Wiz said the bugs had been hidden in PHP’s code for more than a decade and would have been extraordinarily complicated for a human to exploit. “Pre-AI, this manual work would be difficult to implement and even harder to scale,” Wiz wrote. “With AI, this is no longer a barrier.” OpenAI, which NBC reported helped bring the flaws to PHP’s attention, called it “one of the most impactful security issues in recent memory.”
The same tools that find holes can help exploit them. Costin Raiu of the security firm TLP:Black told Reuters that AI was powering a “race to exploit,” with the next step being the “mass compromise of every vulnerable web server on the internet.”
The race was made harder by a breach of trust. According to NBC, the PHP Foundation said the company Chainguard shared details of the patch six hours before its release, breaking an embargo and making it easier for attackers to reverse-engineer the fix. Chainguard had not responded to NBC’s request for comment.
The conservative lessons
First, responsibility starts with the owner. Every agency, business, church, campaign, and civic group that runs a website owns the risk that comes with it. Reuters noted that the danger is highest for small sites run by individuals or organizations with limited technical resources, often on shared hosting where customers do not manage the underlying servers. That is most of the civic internet. Owners should ask their hosting providers, in writing, which PHP version they run and when it will be patched, rather than assume someone else has handled it.
Second, government should get its own house in order before it lectures anyone else. Citizens depend on public websites to file, apply, and comply. The fact that ministries and agencies could only protect those services by switching them off shows how much old, unpatched software sits underneath them. Keeping them current is basic stewardship of taxpayer property. Congress should insist on it through oversight rather than waiting for the next emergency.
Third, resist the urge to nationalize or over-regulate open-source software. Reuters describes PHP as free, open-source software maintained by volunteers. It is an example of the voluntary cooperation conservatives often praise: private individuals and companies building a shared tool that the whole world relies on. Wednesday’s patches came from that community, working with private security firms, not from a regulator. Washington’s proper role is to share threat intelligence quickly, protect federal systems, and prosecute criminals, not to impose rules that would drive volunteers away from the projects that need them most.
Fourth, take AI seriously without panic. AI helped find these flaws, and it may help attackers move faster. The answer is not to ban the tools but to make sure defenders, including small organizations, adopt them as quickly as attackers do.
What to do now
CISA’s checklist is straightforward, and Reuters notes that PHP is built into WordPress, Drupal, Joomla, and Magento: inventory every system that runs PHP, patch internet-facing systems first, take systems offline if they cannot be updated, consider a web application firewall as a stopgap, and watch for PHP processes launching shells or downloading tools.
A self-governing people should not need a crisis to learn that freedom online, like freedom anywhere, depends on ordinary citizens and institutions doing their duty. Patch the servers, hold public agencies accountable for theirs, and honor the volunteers who keep the web running.