Skip to content

PHP2Shell: Europe Is Switching Off Websites. AI Found a Hole in 70% of the Web

AR007 · 22 Oct 2026 · 1:26 · by — AI Strategist, Practitioner & Educator · Founder, AI Center of Excellence

PHP2Shell explained: the critical PHP vulnerability (CVE-2026-109618 and CVE-2026-109619) that made governments in Europe switch off their own websites. AI-assisted researchers found two flaws in PHP, the language behind an estimated 70% of websites, WordPress included. What happened, why Revolut's outage on Tuesday was not this, why abandoned websites are the real risk, and what you can do this week.

Do it now

What to do this week

  1. 1If you run a website, update PHP: the fixes are in 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
  2. 2Don't type passwords, card numbers or anything confidential into a site you don't fully trust.
  3. 3Update your browser and your phone.
  4. 4Use a different password everywhere, with two-factor authentication.

Materials

Take it with you

unPaper · slides with your work AI

Your AI at work can't make slides like Claude or ChatGPT at home?

  1. 1Pick slide type, style and format
  2. 2Copy the prompt into your approved AI at work
  3. 3Get the deck. Company data never leaves your approved environment
Try unpaper.aiFree for individual use, including at work.

You bring the AI. We bring the Craft.

Alexey presents and contributes to unPaper.

Slide made with unPaper: Proceed with a staged Westhaven siteSlide made with unPaper: How shared heat will work at Harbor LoopSlide made with unPaper: Project Atlas rollout statusSlide made with unPaper: 64% needed one partSlide made with unPaper: Aurora Night Line field report

Transcript

Read every word ↓

Governments in Europe are switching off their own websites because AI found a hole in the software behind most of the web. It's called PHP. OpenAI says it runs an estimated 70% of websites, WordPress included. Two critical flaws. One, crafted request, no password, and an attacker can run code on the server. Researchers found them with OpenAI and Google models. Then the details leaked early. Cloudflare CEO, thousands of attack attempts before the announcement, tens of thousands in first forty five minutes, Millions now. NSA says, if you can't update right away, take the system offline.

The Dutch prime minister, patch now. Keep vulnerable systems offline. DigiD and MijnOverheid went dark. And no, Revolut going down on Tuesday wasn't this. Revolut says it was a Google Cloud outage, and your money and data stayed safe. Here is the part almost nobody says. PHP is open source, so the fix is public. And with AI, anyone can read a fix and work back to the hole it closes. A public fix is a map. Big companies patch in hours, but a website built three years ago whose developers moved on, nobody patched it, and it may still hold your data.

So don't be surprised when sites go offline this week. That's them being careful. Don't type passwords, card numbers, or anything confidential into a site you don't fully trust. Update your browser and your phone. A different password everywhere with a two factor authentication. My advice for this week, browse a little less and paste a lot less.

Questions people ask

Was the Revolut outage caused by PHP2Shell?
No. Revolut says it was a Google Cloud outage, and that money and data stayed safe.
Why are government websites going offline?
Because they are being careful. The NSA advises taking a system offline if you can't update right away, and the Dutch prime minister asked to patch now and keep vulnerable systems offline. DigiD and MijnOverheid went dark.

Keep going

Longer video · AS002Personal ChatGPT or Claude for Work Slides? Don't Leak Company Data

Join the Telegram group

New videos and short notes, plus questions you can ask.

t.me/unreasonableai →

Newsletter

Found this useful?

Join the newsletter. You get one e-mail when something new and useful is out: a video, a guide, a tool. No spam, no schedule, and you can leave with one click.