Global Web Sites Go Dark as PHP Flaws Spark Patch Rush, But Exploits Remain Limited

Key points

• Two critical vulnerabilities in PHP were disclosed on October 21, 2026, after being identified in August by researchers using AI tools.
• Government agencies, including the FBI and NSA, along with European and Australian authorities, advised websites to go offline until patches were applied.
• Major sites, including the Port of Rotterdam, Paris police, and 4chan, temporarily shut down to mitigate risks.
• Cloudflare CEO Matthew Prince reported thousands of exploitation attempts in the 10 hours before public disclosure, but confirmed mitigations were deployed for all customers.
• CERT-In issued a critical-severity warning in India, urging urgent updates, while Microsoft CEO Satya Nadella called the scale of the incident unusual.
• Experts from nine cybersecurity firms reported no successful attacks as of Thursday evening, noting that while proof-of-concept code exists, real-world exploitation remains difficult.

Background

This incident follows a series of AI-enabled cyberattacks in 2026, including the Plex2Shell exploit chain and the CLEANGULP malware campaign. The recent breach of OpenAI by bug bounty hackers using AI models highlighted growing concerns about AI-assisted cyber threats. The PHP vulnerabilities, which existed for over a decade, were only recently identified due to advancements in AI tools, reducing the time to exploit from months to hours.

How outlets are covering it

NBC News emphasizes the limited success of hackers in exploiting the PHP flaws, attributing this to technical difficulty and the limitations of open-weight AI models. The Atlantic highlights the broader context of AI-powered cyberattacks, noting recent breaches of companies like John Deere and SharkNinja. The Times of India focuses on the global response, including CERT-In's critical-severity warning and Microsoft CEO Satya Nadella's remarks on the unusual scale of the incident. Cloudflare's Matthew Prince reported thousands of exploitation attempts but confirmed successful mitigations, while Google Cloud warned customers to update their PHP applications.

Why it matters

The PHP vulnerabilities underscore the growing threat of AI-enabled cyberattacks and the need for rapid response in cybersecurity. The incident highlights the importance of proactive patching and the potential for dormant intruders to compromise systems quietly. It also demonstrates the global coordination required to address critical vulnerabilities, with governments and companies working together to mitigate risks.

What to watch

Cybersecurity experts warn that the threat will remain for weeks, if not longer, as hackers continue to scan for ways to exploit the vulnerabilities. Organizations are urged to apply security updates urgently, and governments may issue further advisories as the situation evolves. The incident may lead to increased scrutiny of AI tools in cybersecurity and a push for more robust security measures in web development.