AI v. AI: The new game of offense and defense

AI helped uncover one of the most severe vulnerabilities in software history, affecting PHP, a free, open-source programming language that runs nearly 70% of the internet by working behind the scenes, assembling webpage content on the server before sending it to a visitor's browser. On October 21, 2026, the PHP project released emergency fixes for two critical flaws that let attackers seize web servers without a password. Governments worldwide have urged organizations to patch now or pull vulnerable sites offline, and many government websites, from Europe to Australia, Japan, and the UK, went dark themselves as a precaution. If your organization runs a website, confirming PHP exposure and promptly taking the appropriate next steps is critical.

Key takeaways

• Two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619, nicknamed "PHP2Shell") allow unauthenticated remote takeover of web servers. PHP runs nearly 70% of identifiable websites.¹
• AI models were used both to find flaws and to prove they could be exploited, and those same tools could help attackers.
• On October 26, 2026, CISA listed both vulnerabilities in its Known Exploited Vulnerabilities (KEV) catalog and gave federal agencies three days to patch, without disclosing how many production systems were breached. Industry assessments of successful exploitation remain in flux.
• Compromise may predate public disclosure. Organizations should confirm PHP exposure, follow law enforcement guidance immediately, and watch for signs of intrusion. Guidance from CISA, FBI, and NSA for U.S. entities is discussed below; similar information is coming out of cyber agencies worldwide.

Scope of the problem and why it is such a big deal

According to the PHP project's October 21 security advisory, the two flaws could let attackers run code on a server without logging in, and all PHP installations that handle website requests are at risk. CERT-EU, the EU's cybersecurity response team, reports that each flaw has a severity rating of 9.2 out of 10 under the Common Vulnerability Scoring System (CVSS). CERT-EU warns that commercial and open-source products that use PHP behind the scenes could also be affected, even if their PHP installation is not directly accessible.

The National Security Agency (NSA) stated in its October 21 advisory that PHP2Shell could allow attackers to take control of affected web servers without prior access or authentication, helping them steal sensitive data, disrupt services, or move deeper into a network. NSA emphasized that these are flaws in PHP itself, not in the hosted application or its configuration, and that cyber actors are likely to weaponize them. Researchers have warned that exploitation could expose passwords, authentication tokens, API keys, and certificates held in server memory. And because so many sites share the same underlying software, attackers can scan the internet for vulnerable systems rather than target victims one by one.

How the vulnerabilities were discovered and made public

Researchers reported the first flaw to PHP on August 11 after finding it with an AI company’s frontier model, and a cybersecurity firm independently reported a second flaw on August 24, also using AI models. Researchers then worked quietly across borders and disciplines to develop patches.

On October 20, the PHP security team announced on its website that a critical security release would follow on October 21, reserving the right to release earlier if details became public. CERT-EU states that public reports soon indicated the flaws could lead to remote code execution, and that PHP released the fixes on October 21. News of the flaw reportedly came out before the fix could be delivered to users.

The role of AI

This has been described as an AI-triggered cybersecurity crisis. AI tools helped find one of the most severe online bugs ever, and professionals are racing to patch it before hackers use AI to exploit it. The flaws had reportedly been present for years, but proving they were exploitable required a chain of steps "at the edge of what human researchers could practically achieve."² This incident illustrates how AI can be used both offensively and defensively in cybersecurity.

Impact so far and the risk of dormant threats

Government websites across Europe went dark on October 21, 2026. Australian government websites, including that of the Australian Signals Directorate, experienced outages, and agencies in the Netherlands, Finland, Denmark, and France took services offline. In Japan, ministries, local governments, and banks restricted web services. In the UK, government services, local councils, and large public content websites were reportedly taken down as a preventative measure. The government of Canada announced that some of its websites may be temporarily unavailable while security updates are applied. Public reporting does not indicate U.S. government websites experienced outages, whether precautionary or otherwise.

Reports of successful exploitation continue to evolve. Several early proof-of-exploit claims were revised after closer review revealed mostly scanning and failed attempts. More recently, at least one security researcher reported successful attacks on honeypots, or test systems designed to attract attackers. On October 26, CISA added both Common Vulnerabilities and Exposures (CVEs) to its KEV catalog and set an October 29 remediation deadline for federal civilian agencies. This marked a change from the prior week, when CISA warned of PHP2Shell’s risks but reported no observed successful exploitation in the wild. Current reporting also suggests that open-source AI tools struggle to exploit vulnerabilities of this complexity.

A major cloud services provider identified an exploitation attempt on October 17—four days before public disclosure—and warned that exploitation could precede public disclosure. Patching closes the door, but it does not evict an intruder who may already be inside.

How clients can protect themselves

Detailed technical remediation should follow the official advisories. At a high level, we recommend that clients:

1. Determine whether you have PHP exposure: CISA urges organizations to identify and inventory systems running any version of PHP, noting that PHP is often a component of other software and may not be directly observable. Ask your IT team, hosting providers, website vendors, and digital services suppliers whether internet-facing sites rely on PHP, what version, and whether they have been patched.
2. Patch immediately—or consider taking sites offline: CISA, FBI, and NSA urge immediate patching and prioritization of internet-facing systems, and recommend taking systems offline if they cannot be updated right away.
3. Follow the official guidance: Have your technical teams and vendors consult the CISA alert, the FBI and NSA advisories, and the PHP project's security advisory, which CISA directs network defenders to review.
4. Stay vigilant: NSA advises heightened awareness of PHP-reliant internet-facing services in the coming weeks and close monitoring of vendor patches, and CISA recommends monitoring for suspicious activity.
5. Continued communication: Technical teams, executive leadership, and legal counsel should remain in close communication regarding the company’s exposure, remediation efforts, and risk management. This is especially important given the potentially significant legal and financial consequences of service disruptions and related conflicts with vendors and partners, not to mention exploitation of the vulnerability itself.

Incident response

Because compromise may predate disclosure, organizations that observe suspicious activity on PHP-based systems should treat it as a potential incident: Preserve logs and evidence, isolate affected systems, and evaluate whether sensitive systems or data may have been accessed, which can trigger time-sensitive regulatory, contractual, and insurance notice obligations. If you are concerned about your organization's exposure, please contact your Ashurst Perkins Coie relationship lawyer.

This alert is for informational purposes only and does not constitute legal advice.