AI Exposes Decade-Old PHP Flaws, Sparking Shutdowns Across Japan

Japanese government ministries, banks, railways and restaurant chains pulled websites and apps offline on October 21 and 22 after the developers of PHP, one of the internet's most widely used programming languages, disclosed two critical security flaws that artificial intelligence had helped uncover after more than a decade in hiding.

The bugs, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed "PHP2Shell," let an attacker take control of a web server remotely without logging in. Both carry a severity score of 9.2 out of 10, according to iTnews . PHP released fixed versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on October 21, saying all users were "encouraged to update immediately." Every earlier release is vulnerable.

PHP, originally short for "Personal Page," is a free, open-source language maintained by volunteers. It assembles web pages on the server before they reach a visitor's browser, and it runs roughly 75% of websites whose programming language can be identified, according to web technology tracker W3Techs, including sites built on WordPress, Drupal, Joomla and Magento. "All servers using any version of PHP released in the last 20 years will be vulnerable," Tiffany Farriss, interim chief executive of the Drupal Association, told Reuters . "This issue impacts the majority of the internet."

Tokyo Told Operators To Patch Or Pull The Plug

Japanese Prime Minister Sanae Takaichi took the unusual step of posting a public warning on X on October 21, telling website owners to "check whether your live site uses PHP and prepare to apply the new fix," Reuters reported . She added that if a patch could not be applied promptly, temporarily suspending a website was an effective way to reduce the risk, according to Jiji Press .

The government took its own advice. Chief Cabinet Secretary Minoru Kihara confirmed on October 22 that parts of the websites of the Finance Ministry and the Ministry of Health, Labor and Welfare had been suspended as a precaution, while stressing that no damage to government sites had been reported. He urged operators to apply the patch as quickly as possible or take pages offline until they could.

Local authorities followed. The Tokyo Metropolitan Government suspended some services, including the website for its official app, and Osaka Prefecture and the city of Osaka halted some functions. Police in Saga Prefecture in southwestern Japan temporarily took down their website. Even the website Takaichi uses as a lawmaker went down for maintenance on the night of October 21 and was restored the morning, her office told Kyodo News .

Japanese Companies Chose Caution Over Uptime

Corporate Japan responded with a wave of precautionary closures:

Transport: West Japan Railway Co. (JR West) suspended 60 group websites for emergency maintenance. All Nippon Airways halted its website and app, including Apple Wallet boarding passes, and Keihan Holdings also carried out emergency work on its sites.

Finance: MUFG Bank suspended some services, including online opening of investment trust accounts. Mizuho Financial Group, Nomura Securities and regional lenders such as Shizuoka Bank also halted some online services .

Consumer brands: Zensho Holdings stopped app services for its Sukiya beef bowl chain and Hama-sushi conveyor belt sushi restaurants from the night of October 21. Brewer Asahi Group closed some websites and systems, and game makers Sega and Bandai Namco ran emergency maintenance.

Infrastructure: The Japan Meteorological Agency carried out emergency maintenance , and cloud provider Sakura Internet suspended some functions .

Not everyone saw the closures as prudence. Toshio Nawa, a prominent Japanese cybersecurity consultant, argued that the rush to go offline reflected executives frozen by fear of blame, after years in which Japanese corporate leaders have repeatedly bowed in public apology over data breaches.

"The failure of judgment among senior management is the deeper vulnerability exposed by this wave of system shutdowns," Nawa said, according to international media reports including the Financial Times.

Europe Took Ministries, Ports And Hospitals Offline

The response was just as dramatic in Europe. The Dutch National Cyber Security Centre took its own website down as a precaution, and the Port of Rotterdam, the government portal Overheid.nl, the national soccer association KNVB, the five largest political parties and several hospitals followed. France's Interior Ministry put all of its websites into preventive maintenance, Finland's state IT provider Valtori took government public network services offline, and Danish municipal IT company Kombit shut down services including the national school communication platform. More than 30 U.K. government services were still down on October 22 .

The U.S. National Security Agency and European cybersecurity authorities told organizations to act immediately, and CERT-EU, the cybersecurity service for European Union institutions, advised cutting internet-facing applications off from public networks where patching was not possible. The White House said it had been made aware of the flaws on October 16.

In the Asia-Pacific, the Australian Signals Directorate issued an unusual pre-patch alert, and Cyber Security Minister Tony Burke said some government websites would stay offline while fixes were carried out, according to media reports. Cybersecurity authorities in Taiwan, Hong Kong and Singapore also published warnings and defensive guidance, while Alibaba Cloud and Tencent Cloud told customers to upgrade to patched versions.

Wikipedia's operator, the Wikimedia Foundation, and the Internet Archive both took systems down temporarily. Automattic, which runs WordPress.com and Tumblr, said its hosted users were protected ; the greater risk lies with small sites on shared hosting run by people with few technical resources.

Hackers Probed The Bugs Four Days Before Disclosure

Attackers did not wait for the announcement. Amazon security chief CJ Moses said the company detected an attempt to exploit the flaws against one of its decoy "honeypot" systems on October 17, four days before public disclosure, and that it was unclear how the anonymous actor had learned of them while they were under embargo. Amazon said the flaws were "now being broadly exploited in the wild."

Cloudflare CEO Matthew Prince said on X that exploitation attempts surged from "tens of thousands in the 45 minutes post announcement, hundreds of thousands within two hours, and millions now." The coordinated disclosure had also unraveled early, after a Hacker News user posted the CVE numbers ahead of schedule and a researcher published alleged exploit code online.

The patching task is enormous. 1.5 million of 2.6 million hosts examined by internet intelligence firm Censys report running a version of PHP for which there is no fix, meaning operators must first upgrade to a supported release. AI is powering a "race to exploit," said Costin Raiu, co-founder of cybersecurity firm TLP:Black, warning that the step was the "mass compromise of every vulnerable web server on the internet."

AI Models From Google And OpenAI Found The Flaws

What sets PHP2Shell apart is how it was found. Security company Calif said it identified the flaws with the help of a large language model on August 1. Researchers at Wiz, a cloud security firm owned by Google parent Alphabet, separately found them using their own AI research tool, Wiz Atlas, together with Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol. The two companies said they coordinated with each other, the PHP team and OpenAI on the fixes.

Wiz said the bugs would have been extraordinarily complicated for a human hacker to exploit. "Pre-AI, this manual work would be difficult to implement and even harder to scale," it wrote. "With AI, this is no longer a barrier." OpenAI said its models had helped discover the flaws and that the episode "marks a new phase, where AI can find security bugs with internet-scale impact."

That cuts both ways. "The scale is huge, and with AI, exploitation may happen instantly," said Lukasz Olejnik, a visiting senior research fellow at King's College London.

Why Taiwan Cannot Afford To Patch Slowly

For Taiwan, the risk is familiar. When an earlier PHP flaw, CVE-2024-4577, was disclosed in 2024, Taiwan became the main target of the attacks that followed, according to security firm Bitdefender , with some compromised servers hijacked for cryptocurrency mining and other malware.

With PHP running quietly inside countless government, university and corporate websites, specialists warn that many organizations may not even know they rely on it. Their advice matches Tokyo's: find every PHP system, install the patched versions, and take services offline if that cannot be done right away.

Related News & Content

Internet faces AI hacking ‘tsunami’ amid PHP crisis – security experts

Asian governments step up cyber defenses after PHP flaw