• October 22, 2026
AI Found a 14-Year-Old Bug in PHP: PHP2Shell Forces Government Websites Offline Worldwide as 70% of the Web Races to Patch

Security firm Calif, working through OpenAI’s Patch the Planet initiative, used GPT-5.6 Sol to uncover two critical PHP vulnerabilities dormant for over 14 years — CVE-2026-109618/109619, collectively dubbed PHP2Shell (CVSS 9.2) — enabling unauthenticated remote code execution. After details leaked a day early, the NSA issued a rare public warning, government websites in Canada, Australia and Europe went dark as a precaution, and Japan’s PM personally cautioned the public. With roughly 70% of the web built on PHP, defenders are racing attackers to patch.