PHP2Shell: Europe Is Switching Off Websites. AI Found a Hole in 70% of the Web
AR007 · 22 Oct 2026 · 1:26 · by Alexey Makarov — AI Strategist, Practitioner & Educator · Founder, AI Center of Excellence
PHP2Shell explained: the critical PHP vulnerability (CVE-2026-109618 and CVE-2026-109619) that made governments in Europe switch off their own websites. AI-assisted researchers found two flaws in PHP, the language behind an estimated 70% of websites, WordPress included. What happened, why Revolut's outage on Tuesday was not this, why abandoned websites are the real risk, and what you can do this week.
Do it now
What to do this week
- 1If you run a website, update PHP: the fixes are in 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- 2Don't type passwords, card numbers or anything confidential into a site you don't fully trust.
- 3Update your browser and your phone.
- 4Use a different password everywhere, with two-factor authentication.
Materials
Take it with you
unPaper · slides with your work AI
Your AI at work can't make slides like Claude or ChatGPT at home?
- 1Pick slide type, style and format
- 2Copy the prompt into your approved AI at work
- 3Get the deck. Company data never leaves your approved environment
You bring the AI. We bring the Craft.
Alexey presents and contributes to unPaper.





Transcript
Read every word ↓Hide ↑
Governments in Europe are switching off their own websites because AI found a hole in the software behind most of the web. It's called PHP. OpenAI says it runs an estimated 70% of websites, WordPress included. Two critical flaws. One, crafted request, no password, and an attacker can run code on the server. Researchers found them with OpenAI and Google models. Then the details leaked early. Cloudflare CEO, thousands of attack attempts before the announcement, tens of thousands in first forty five minutes, Millions now. NSA says, if you can't update right away, take the system offline.
The Dutch prime minister, patch now. Keep vulnerable systems offline. DigiD and MijnOverheid went dark. And no, Revolut going down on Tuesday wasn't this. Revolut says it was a Google Cloud outage, and your money and data stayed safe. Here is the part almost nobody says. PHP is open source, so the fix is public. And with AI, anyone can read a fix and work back to the hole it closes. A public fix is a map. Big companies patch in hours, but a website built three years ago whose developers moved on, nobody patched it, and it may still hold your data.
So don't be surprised when sites go offline this week. That's them being careful. Don't type passwords, card numbers, or anything confidential into a site you don't fully trust. Update your browser and your phone. A different password everywhere with a two factor authentication. My advice for this week, browse a little less and paste a lot less.
Questions people ask
- Was the Revolut outage caused by PHP2Shell?
- No. Revolut says it was a Google Cloud outage, and that money and data stayed safe.
- Why are government websites going offline?
- Because they are being careful. The NSA advises taking a system offline if you can't update right away, and the Dutch prime minister asked to patch now and keep vulnerable systems offline. DigiD and MijnOverheid went dark.
Keep going
Longer video · AS002Personal ChatGPT or Claude for Work Slides? Don't Leak Company DataNewsletter
Found this useful?
Join the newsletter. You get one e-mail when something new and useful is out: a video, a guide, a tool. No spam, no schedule, and you can leave with one click.