PHP2Shell flaws trigger global website shutdowns and millions of hacking attempts
Two critical PHP vulnerabilities tracked as PHP2Shell (CVE-2026-109618 and CVE-2026-109619) allow remote code execution and full server compromise, prompting website shutdowns worldwide, including German government agencies in Rhineland-Palatinate, Saarland, Thuringia, Baden-Württemberg and North Rhine-Westphalia. Cloudflare CEO Matthew Prince cited "millions" of hacker attempts. Emergency patches have been released, with Ionos and Cloudflare deploying protections, while the NSA issued a patching advisory and Amazon Threat Intelligence found exploitation before public disclosure.
Reference imageEditorial responsibility
- No named human review is recorded for this page.
- Reports are grouped by semantic similarity and deterministic rules. Language models may assist titles, summaries, translation and cross-source analysis; the page reads the event directly, while its address stays stable when the title changes.
- Summary covers the current reports
Cross-source coverage
Common ground
- The '70% of the internet' claim is inaccurate; the correct figure is roughly 70% of websites, not the entire internet.
- The real headline is that patches are available, but adoption and deployment are the open questions.
- The German hospital and police outages were not proven to be caused by this specific PHP flaw, and that claim was dropped.
- The unpatched long tail of vulnerable systems is a genuine concern, but its exact size remains unmeasured.
- Market failure—vendors disappearing and leaving costly dependencies—is a real problem that justifies some form of governance or procurement reform.
- The cost of inaction is already being paid in ransomware, downtime, and stolen data, even if it is not a visible budget line.
- Auditing agencies and critical infrastructure are underfunded, and any fix must address that capacity gap.
Points of contention
- Whether the unmeasured size of the unpatched tail should push us toward urgent action or toward caution until better data exists.
- Whether mandatory security standards and procurement reform would actually work or just add work to already broken, underfunded institutions.
- Whether 'we don't know' is itself a scandal that justifies action, or just a gap in inventory that should not be used as a permanent license for urgency.
- Whether the status quo is affordable—one side says the hidden costs are already crushing, the other says nobody has proven that either.
Blind spots
- Nobody produced actual numbers on how many exposed PHP instances remain unpatched weeks after the fix.
- The debate never fully addressed who specifically would pay for escrow requirements, liability regimes, and support windows.
- Both sides treated 'AI found it' as either hype or heroism without deeply examining how AI changes the offense-defense balance.
- The discussion largely ignored non-website PHP uses like IoT, routers, and email infrastructure.
- No one proposed a concrete way to measure the hidden costs of inaction versus the visible costs of reform.
WorldAttention’s read
This debate started with a scary headline and ended with a sharper, smaller, and more honest picture. The '70% of the internet' claim was wrong—it is roughly 70% of websites—and the German hospital outages were never tied to this flaw, so that claim was dropped. What remains is a real governance problem: a widely used language had a serious flaw for years, patches are out, but nobody knows how many exposed systems are still unpatched. One side argues we should act now on a hunch because the hidden costs of doing nothing are already being paid. The other side argues we should not let 'we don't know' become a permanent excuse for urgency without measurement. Both agree on the practical steps: fund the auditors, write escrow and liability rules, fix procurement, and be honest that we are acting on incomplete data. The final lesson is that negligence did not wear a lanyard—it wore a spreadsheet and said 'someone else's problem.'
Reporting timeline
Critical PHP Vulnerability Triggers Global Website Shutdowns and Millions of Hacker Attempts
A newly discovered critical vulnerability in the widely used programming language PHP, tracked as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), allows attackers to remotely execute malicious code and fully compromise affected servers. The German Federal Office for Information Security (BSI) and international experts warn of acute danger, prompting many website operators—including numerous German government agencies in states such as Rhineland-Palatinate, Saarland, Thuringia, Baden-Württemberg, and North Rhine-Westphalia—to take their sites offline as a precaution. Cloudflare CEO Matthew Prince told Sky News that there have been "millions" of hacker attempts worldwide to exploit the flaw. While end-user devices are not directly at risk, sensitive data on affected servers could be exposed. Emergency updates have been released, and large web hosters like Ionos have already patched their systems. Experts expect automated attack waves to continue for weeks or months until widespread patching is complete.
Read sourceHackers Exploited PHP Vulnerabilities Before Patches, AI Tool Uncovered Critical RCE Flaws
Multiple reports indicate that hackers exploited critical PHP vulnerabilities days before patches were released. Wiz.io describes PHP2Shell, an AI-discovered remote code execution flaw affecting 70% of the internet. The BBC reports a global scramble to fix critical cyber-security flaws, with many websites taken offline. The NSA issued an advisory recommending critical patches for PHP vulnerabilities. Amazon Threat Intelligence identified PHP2Shell exploitation prior to public disclosure through its MadPot system. The coordinated response highlights the severity of the vulnerabilities and the rapid exploitation by attackers.
Read sourceAI-Assisted Discovery of PHP Flaw Triggers Global Website Shutdowns and Patching Rush
An AI-assisted discovery of a critical PHP vulnerability, described as potentially affecting up to 70% of the internet, has triggered global website shutdowns and a rush by companies and governments to patch affected systems, according to Fortune, CNN, and Reuters. Reuters reports millions of hacking attempts amid the patching effort. Amazon Web Services' threat intelligence unit says it identified PHP2Shell exploitation prior to public disclosure through its MadPot system. A Guardian opinion piece by Chris Stokel-Walker argues that more website shutdowns should be expected in the age of AI, but attributes the real culprit to human inaction rather than the technology itself.
Show 2 older updatesHide older updates
PHP Vulnerabilities Could Put Much of the Internet at Risk, Experts Warn
Multiple news outlets are reporting on critical PHP vulnerabilities, collectively referred to as PHP2Shell, that could affect a large portion of the internet. According to wiz.io, AI was used to uncover these remote code execution (RCE) flaws, which are said to impact 70% of the internet. POLITICO.eu reports that hackers have launched 'millions' of attempts to exploit this global PHP cyber flaw. In response, Cloudflare has deployed protections against the php2shell vulnerability, as noted on their blog. CNET warns that these PHP vulnerabilities could put much of the internet at risk, citing experts. The Economist raises the broader question of whether the internet is still safe in light of these developments.
Read sourceCritical PHP Flaws Discovered by AI Trigger Global Security Scramble
A set of critical PHP vulnerabilities, reportedly uncovered with the help of AI agents, has triggered a global cybersecurity response. WIRED described the situation as "This Is Not a Drill," while Reuters reported that government websites went dark after the AI-discovered flaw sparked a security scramble. DW.com reported that PHP developers say key patches are now available following the global scare that sent agencies scrambling. OpenAI framed the effort as "Patch the Planet," describing global response coordination as agents uncover critical vulnerabilities. Security firm wiz.io labeled the issue "PHP2Shell," saying AI uncovered critical remote code execution (RCE) vulnerabilities affecting 70% of the Internet. The reports collectively indicate that patches have been released and that coordinated remediation is underway, though the full scope of impact and exploitation remains under assessment.
Read source