The Davies crest — Davies Daily logo
Davies Daily
All the News of the Davies World
Just The Fact No Opinion. THATS WHAT YOUR OWN MIND IS FOR.
Thursday, October 22, 2026 Join the Daily
A DMC LLC · Davies Media Conglomerate
World News

A Flaw In The Code Behind Most Websites Set Off A Global Patch Rush

Two critical flaws in PHP — the language behind roughly 70 percent of the world’s websites — were patched on Wednesday. Within hours, exploit attempts had jumped from thousands to millions, and governments were taking services offline rather than risk it.

By Davies Daily Staff Reports · Friday, October 23, 2026

A data center server room.
A data center. Photo: BalticServers.com, via Wikimedia Commons, CC BY-SA 3.0 — file photo.

Two critical security flaws in PHP, the programming language behind an estimated 70 percent of the world’s websites, have set off a worldwide rush to patch — or to pull sites offline entirely, The New York Times reports. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed “PHP2Shell,” allow an attacker to run code on a vulnerable server without any password at all.

The flaws were found with the help of AI tools — discovered by Ryan Austin of Calif using an advanced OpenAI model, the Wall Street Journal reports; OpenAI says it spent two months leading the fix effort alongside PHP’s developers. Patches were released on Wednesday, October 21 — brought forward after details of the flaws leaked. Cloudflare’s Matthew Prince said exploit attempts rose from thousands before the announcement to millions within hours.

Governments moved first and asked questions later: the United Kingdom reported 32 government services offline as a precaution, with the Netherlands, Finland, Japan, Brazil, France, Canada and Australia among the countries reported affected. The NSA and the FBI issued patch-or-offline warnings. The U.S. cybersecurity agency CISA said that, as of reporting, it had identified no confirmed successful breaches.

The Facts

  • The flaws: CVE-2026-109618 / -619 (“PHP2Shell”) — unauthenticated remote code execution in PHP, the language behind ~70% of websites.
  • The discovery: found with AI tools (an advanced OpenAI model); patches released October 21, moved up after a leak.
  • The rush: Cloudflare saw exploit attempts jump from thousands to millions within hours of the announcement.
  • The official line: NSA/FBI urged patch-or-offline; UK reported 32 services down as a precaution; CISA: no confirmed successful breaches yet.

Sources: The New York Times; the Wall Street Journal; Cloudflare.

Comments