Skip to content
NewSQL, Python and Power BI training for your team
Log in

Black October: The AI-Found PHP Flaws That Shook the Web

AI uncovered two decade-old flaws in the language behind about 70% of websites. Here is what happened, and how to protect your site.

Muhammad Jamilu Abdullahi 9 min read
Dark cover reading Black October, with a glowing amber key over a wall of website windows and three key figures

On the afternoon of 21 October, just before 3pm in Abuja, the volunteers who look after PHP pushed out an emergency update. Within 45 minutes, Cloudflare was counting tens of thousands of attempts to break into websites through the holes it fixed. Within a day, the count was in the millions.

Across Europe, governments did something unusual. They switched off their own websites. Finland, the Netherlands, Belgium and France pulled services offline while engineers patched. In Japan, the prime minister urged every site owner to check whether they used PHP.

The bugs had been sitting inside PHP for more than a decade. What finally exposed them was not a lone human auditor. It was artificial intelligence.

That is why some researchers have started calling this month "Black October".

What happened

PHP is the language behind a huge slice of the web. Wiz, a security firm owned by Google's parent Alphabet, estimates it powers about 70% of websites. As Newsweek pointed out, that does not mean 70% of websites are vulnerable.

The two flaws, nicknamed PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. Both scored 9.2 out of 10 for severity. They let an attacker with no password run their own code on a server, in some set-ups with a single web request. Wiz says every PHP version released in the past decade, back to 5.4, is hit by at least one of them.

The discovery came in August. Security firm Calif, working with OpenAI under what the company calls its Patch the Planet initiative, reported the first flaw on 11 August, reportedly using OpenAI's GPT-5.6 Sol model. Wiz, which used several AI models including Google's Gemini 4 Argon, reported the second on 24 August. OpenAI called PHP2Shell "one of the most impactful security issues in recent memory".

The plan was a quiet, coordinated fix. It did not survive. The bug numbers leaked on 20 October, Calif accidentally posted a video of its exploit, and software firm Chainguard shipped patched builds more than six hours before the official release. The PHP Foundation said Chainguard broke the embargo. Chainguard denied leaking anything.

Date (2026)What happened
11 AugCalif reports the first flaw to PHP
24 AugWiz reports the second flaw
17 OctAmazon's decoy servers log an exploit attempt, four days early
20 OctBug numbers and an exploit video leak; PHP brings the fix forward a day
21 OctFixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 released; government sites go dark
22 OctGhana gives state agencies seven days to patch
23 OctPHP flags a third, lower-risk bug (CVE-2026-115560)
26 OctUS cyber agency CISA lists both flaws as exploited in real attacks

PHP2Shell was not the month's only shock. Indian certificate authority eMudhra had to revoke eight intermediate certificates, and browser makers moved to block them, after a researcher found their secret keys could be guessed in 256 tries. One key was literally the number 4.

Developer platform Railway told customers to revoke and reapply stored secrets after an attacker hunting for AI keys got into its build systems. Microsoft said a China-aligned group, Storm-0940, used an AI agent framework in a supply-chain attack through ConnectWise backup software that targeted more than 2,250 Microsoft 365 tenants. A separate flaw in Google's Brotli compression library forced patches across Node.js and many other tools.

Our earlier story, The Year AI Agents Broke Out, looked at AI test bots breaking into real companies. October showed what happens when AI turns to the plumbing of the web itself.

What PHP and "remote code execution" mean

Think of a website as a shop. The page you see is the display window. PHP is the attendant behind the counter who takes each request, fetches the right goods from the store room and hands them over. It was created in the early 1990s and first stood for "Personal Home Page". WordPress, Drupal and Joomla all run on it.

Remote code execution means a stranger outside can give that attendant orders, and the attendant obeys. The stranger can empty the store room, change prices, hide a back door for later or use the shop to attack others.

Now picture Wuse Market in Abuja, where one locksmith fitted the same lock on thousands of shops years ago. PHP2Shell is like learning that lock has a master key. It doesn't matter how neat your shelves are. Updating WordPress, themes or plugins does not fix it, because the weakness sits in PHP itself, underneath them.

Why it matters

Scale is one reason. Internet-scanning firm Censys estimated on 27 October that more than 32 million PHP services were still running an affected version.

Speed is the bigger one. Wiz said frontier AI models sharply lowered the barrier to turning an old weakness into a working attack. Chainguard's chief executive said that once his team heard something was coming, they found the same bugs with a frontier model, starting from a basic prompt.

The PHP Foundation put it plainly: "Tools now find bugs faster than ever, for defenders and attackers alike." OpenAI's president, Greg Brockman, said he expects many more such issues in the coming months. Chief executive Sam Altman told Stanford students he no longer believes the world can simply patch every bug, and that defence must use the same AI.

The other side

For all the alarm, the damage so far looks smaller than the fear. Germany's cyber agency saw attacks but, at first, no successful break-ins. Its vice-president, Thomas Caspers, said: "It seems a little bit more complicated than expected to exploit."

On 24 October, CISA said it knew of no organisation successfully hacked through the flaws. Two days later it added them to its exploited list. By then, a researcher had recorded 35 successful shell executions on honeypots set up to be easy targets. Wiz says its own data shows no successful end-to-end attack, and the number of exposed vulnerable machines it tracks fell about 67% within days.

Many takedowns were simple caution. Nepal pulled government and banking sites offline, then patched thousands of sites on its shared government platform centrally and brought most back within days.

The bug was also not entirely new. A PHP developer spotted signs of the memory problem in 2024, but the fix stalled. The PHP Foundation itself called the delay a structural failure, blaming its decision process and lack of resources. That is a lesson about underfunded open-source volunteers as much as about AI.

What it means for Nigeria and Africa

A great many Nigerian business websites, school portals and blogs run on WordPress or other PHP software, usually through shared hosting. That puts the country squarely in the blast zone.

The official response looked thin. On 21 October, Nigeria's computer emergency team, ngCERT, posted a warning on X. Technext called it "a casual 'Patch Now!' admonition on X", with no technical bulletin and no compliance push across government agencies.

Neighbours went further. Kenya's ICT ministry issued a formal advisory on 21 October, telling every government body to find its PHP systems, patch them, and restrict or switch off anything that could not be fixed. Ghana's Cyber Security Authority and NITA gave public institutions seven days to patch and report back. In Uganda, the Daily Monitor reported official silence.

The stakes are high. Nigerian officials have long put the country's cybercrime losses at about $500m a year. NITDA's response team warned WordPress users about a separate critical login-page flaw in August, so the machinery for detailed advisories exists. We found no formal NITDA advisory on PHP2Shell at the time of writing.

What to do now

  1. Ask your host one clear question. If you use shared hosting, ask whether PHP is patched for both PHP2Shell flaws and whether services were restarted. Some hosts backport fixes without changing the version number, so ask for a PHP build dated 21 October or later.
  2. Update PHP if you run your own server. Move to 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer. PHP 8.1 and older get no official fixes, and 8.2 reaches end of life on 31 December.
  3. Update WordPress and plugins as well. It won't fix PHP2Shell, but attackers love a site with two open doors. Delete plugins you no longer use.
  4. Take unpatchable sites offline. If an old site can't be updated, switch it off until it can. Cloudflare's free plan includes rules against known PHP2Shell attacks, but that is a stopgap, not a fix.
  5. Check for intruders and rotate keys. Look for unknown admin accounts and strange new files. If anything looks wrong, change your database passwords and your Paystack, Flutterwave or Monnify keys.
  6. Ordinary users: install nothing. There is no PHP patch for your phone or laptop. Ignore any message asking you to download a PHP security update or to confirm your BVN or NIN through a link.
  7. Watch the regulators and the AI labs. Look out for a formal ngCERT or NITDA directive, the fix for the third PHP bug in the next regular release, and more AI-found flaws.

AI found a lock that had been broken for over a decade. The next master key may be found by someone who never reports it, so patch now and keep patching.

Sources

Keep reading

All posts