AI-generated article. This article was researched and drafted using AI tools and published automatically, and its featured image was generated by AI. Facts are drawn from the sources cited in the text.
Somewhere in an inbox this week there is a message from a web host with an urgent subject line about a PHP security update, and a fair number of small business owners have already scrolled past it. That is a reasonable reaction. Most owners never chose PHP, could not say which version their site runs on, and have had no reason to care until now. This one is worth two minutes, though not quite for the reason the security press is giving.
What actually happened on October 21
The PHP project shipped emergency patches for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, now going by the name PHP2Shell. Help Net Security’s write-up is blunt about the scope: every PHP installation that serves web requests is affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Scale is what made governments move. CyberScoop reports that PHP runs the server side of roughly 70 to 80 percent of websites whose language is known, with researchers putting more than 1.3 million internet-exposed hosts in range and a Shodan count near 1.9 million. CERT-EU said the flaws may reach back as far as PHP 5. Finland pulled some government services offline. Edinburgh council and the BBC took pages down. The UK’s NCSC told organizations to find every PHP installation, patch internet-facing systems first, and consider taking a system offline if it cannot be mitigated quickly.
Both of the teams that found it used models
This is where the story stops being an ordinary patch cycle. Calif found the first flaw in August using OpenAI’s GPT-5.6 Sol, as part of a PHP source audit OpenAI funded. Wiz, now part of Google, found both independently weeks later using its own tooling alongside Gemini 4 Argon and GPT-5.6 Sol. Google’s security blog credits Gemini with contributing to the discovery, the exploit development, the detection work and the patch validation. OpenAI called the result a “Defender’s Window” and said it expects findings like this to increase sharply.
Calif was noticeably cooler about it. The company says it used generally available models with no special tooling, and that knowing PHP’s history mattered more than the model did. Two readings of the same event, and both are defensible. The Wiz researchers put the uncomfortable half plainly: “This changes the economics of both discovery and exploitation.”
That cuts both ways, and pretending otherwise would be dishonest. Defenders found these two first. The same drop in effort applies to whoever goes looking next.
Why the PHP security update is probably not your job
The practical translation for a business with no technical staff is smaller than the headlines suggest. If the site sits on managed or shared hosting, the host controls the PHP build, so the patch is their work, not something an owner applies by hand. The useful action is to ask.
One finding is worth looking for in the answer. CyberScoop, citing VirusTotal data, counts roughly 758,000 servers still running PHP branches between 5.4 and 8.1, which no longer receive security updates at all. For sites in that group there is no patch to wait for. The fix is a version upgrade, a different conversation with a different cost, and exactly the sort of thing that stays invisible until a week like this one.
The real lesson is about time, not bugs
Fastly’s Kelly Shortridge told CyberScoop that the gap between disclosure and widespread exploitation is typically hours to a few days. Amazon Threat Intelligence reported an exploitation attempt on October 17, four days before public disclosure, which suggests somebody had details under embargo. Cloudflare switched on firewall rules for every customer, free tier included, about nine hours before the patches landed.
Add that up and the window an owner actually has is not a week. It is the time between their host noticing and their host acting, and nobody outside that chain can see it. This is the same shape of problem as an API key going missing and someone else quietly spending the AI budget. The exposure sits in infrastructure the business depends on and never looks at.
The more useful question is not whether these tools make the internet safer or more dangerous. They are doing both at once, this week, in the same story. It is whether a business with no security staff is anywhere on the list of people told early. On current evidence, it is not.
One small place to start
Not a security program. One email.
Ask the hosting provider two things: which PHP version the site runs, and whether it has been updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. If the version comes back below 8.2, that is the finding, and it was already true last month. Note the name of whoever answers, because the next one of these will need the same channel.
Owners who do only that are further along than most, and it took ten minutes. The same instinct is worth applying to the other quiet dependencies, including what AI companies are now allowed to do with a business website, and the general problem of keeping up with the pace of all this without a full-time job doing it.
OpenAI says it has already found other serious flaws and expects more. If that holds, the next PHP2Shell will not be an unusual week. It will be a Tuesday, and the question is what a small business is supposed to do with a warning that arrives through a host it has never spoken to.
