Global PHP Crisis Hits the Internet: Websites Taken Offline Over AI-Discovered Security Flaws
Originally published in Turkish. Read the original →
Critical remote code execution (RCE) flaws found with AI tools in PHP, the language that powers roughly 70 percent of websites worldwide, set off a global cybersecurity alarm. After urgent warnings from the FBI, the NSA and national cybersecurity centers, public institutions and digital service portals in many countries were temporarily taken offline until patches were applied.
Critical security flaws found in the PHP programming language, one of the most fundamental building blocks of the global internet infrastructure, have set off a cybersecurity alarm of a kind rarely seen around the world. The vulnerabilities uncovered in the PHP core, which powers roughly 70 percent of active websites and content management systems on the internet, pushed international intelligence and security agencies into emergency mode. Many public institutions, ministries, local governments and critical digital service platforms that could not roll out security patches immediately decided to temporarily take their websites offline to head off possible cyberattacks.
This crisis marks a new turning point in cybersecurity history, not only because of the enormous scale of the systems it affects but also because of how the vulnerabilities were discovered. These complex bugs, which had been hiding in PHP's core codebase for more than a decade and had slipped past traditional code audits, were brought to light by advanced AI-powered security scanning models.
How Did AI Discover Decade-Old Code Bugs?
Extensive work carried out by experts at the cybersecurity research firms Calif and Wiz showed the level advanced AI models have reached in finding deep logic and memory bugs in complex software architectures. The PHP core vulnerabilities, which human researchers and standard static analysis tools had failed to notice for years, were detected after large language models and autonomous code analysis agents examined the source code in depth.
The AI tools used in the research did not just flag potential bug locations; they also verified the findings by simulating under which conditions these vulnerabilities could be triggered and how they could be exploited. This development, which proves how much AI has accelerated both defensive and offensive processes in cybersecurity, has reignited the debate about the security of critical open source infrastructure software.
Technical Details of CVE-2026-109618 and CVE-2026-109619
The two main vulnerabilities officially recorded as a result of the AI-assisted analysis were identified as CVE-2026-109618 and CVE-2026-109619. These flaws, which the industry has also started calling by names like PHP2Shell, carry an extremely high risk score of 9.2 on the CVSS v4.0 severity scale.
The main threats these two critical vulnerabilities pose for system administrators and software developers are:
- Remote Code Execution (RCE): Attackers can run system commands directly on the target server through specially crafted HTTP requests, without needing any authentication.
- Full Server Takeover and Data Breach: If the flaw is successfully exploited, malicious actors can access sensitive databases on the server, modify system files and gain persistent access by planting backdoor software.
- Wide Attack Surface: Memory handling and input validation flaws that can be triggered even in standard configurations directly threaten a wide range of releases, from old versions to current PHP branches.
FBI and NSA Warn: If You Can't Install the Patch, Stay Offline
Once the scale of the threat became clear, the US Federal Bureau of Investigation (FBI), the National Security Agency (NSA) and national cybersecurity centers in Europe issued emergency bulletins one after another. Security authorities warned that the flaws could be quickly weaponized by cybercrime groups and state-backed threat actors using automated scanning bots.
The most striking item in the declarations published by officials was the call for urgent action. Organizations unable to apply the emergency security patches right away because of their system architecture, legacy plugin dependencies or operational processes were advised to take their servers completely offline temporarily (pull the plug) until patching was complete. Officials stressed that a controlled outage of a few hours or days is a far safer choice than suffering a cyberattack that leads to a data leak or a ransomware disaster.
Many Public Sites Suspended From Europe to Asia
This stern warning from international security agencies triggered a fast domino effect on a global scale. In many countries, led by France, Germany, the Netherlands, Finland and Japan, ministry portals, police information pages, port and airport logistics systems and local municipality sites were taken offline one after another.
Although the maintenance and access-blocked screens users saw when trying to reach these platforms initially caused panic about a global cyberattack, the authorities quickly clarified the situation. Official statements said the outages were not the result of a successful cyberattack; the systems had been temporarily isolated purely as a preventive measure and to allow a safe patch rollout.
Turkey's Cybersecurity Directorate Takes Action
After the PHP crisis that reverberated around the world, Turkey's national cybersecurity mechanisms also kicked in quickly. The Cybersecurity Directorate (Siber Güvenlik Başkanlığı) and the related coordination units issued a national-level security warning to public institutions and critical infrastructure operators.
While comprehensive vulnerability scans were launched for public servers and corporate web infrastructure across Turkey, urgent notifications were sent to IT centers. System administrators were asked to review all PHP-based applications in their inventory, take the necessary isolation steps on internet-facing servers and complete the official security updates without delay.
The Fix and the Urgent Measures to Take
As the crisis broke, the PHP developer community and The PHP Foundation quickly released security updates that fix the vulnerabilities. To secure their servers, developers and system administrators need to move immediately to PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 and the latest stable versions that include the related security patches.
In addition to updating, cybersecurity experts recommend carrying out the following steps in full:
- Review Server Logs: Web server access and error logs (
access.loganderror.log) should be scanned retroactively for unusual HTTP requests, suspicious parameter sequences and unexpected attempts to spawn child processes. - Web Application Firewall (WAF) Rules: Virtual patching rules that block exploit signatures for CVE-2026-109618 and CVE-2026-109619 should be enabled on cloud-based or on-premises WAF solutions.
- File Integrity Check: You must verify whether any unauthorized file uploads or configuration changes were made during the period the server was exposed to the internet before patching.
In this new era where AI can find decade-old hidden code flaws within minutes, postponing software update processes is no longer an acceptable risk. The global PHP crisis proves once again how vital proactive patch management and Zero Trust architecture are in the modern internet world.
