The Official Fix Was to Unplug the Internet

A flaw in the internet hid for fourteen years. Artificial intelligence found it. Cyber agencies advised website owners to patch their sites or turn them off — and several governments took the second option on their own websites.

The vulnerabilities, dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10), sit inside PHP, the programming language that powers roughly three quarters of the world's websites. They allow an unauthenticated attacker to take over a vulnerable server completely. The flaws trace back to PHP 5.4 in 2012 and went undetected for about fourteen years — until they were found by AI systems working for security researchers at Calif and at Google's Wiz team, who turned one of them into a working exploit in about a week.

Emergency patches shipped on October 21, 2026. The UK's National Cyber Security Centre, the US National Security Agency, and the EU's CERT-EU all advised patching immediately or taking systems offline. The Netherlands' own cyber agency took its website offline as a precaution. Finland, France, and the UK also saw government sites go dark.

The software that runs most of the internet was written in 1994. The bug outlived fourteen years of human reviewers. The robots found it in days, and the official fix was the oldest one in technology: turn it off and see if that helps.

The underlying reporting is filed in the Evidence Locker: Computer Weekly (Oct. 21, 2026).