PHP2Shell Fallout: Governments Take Websites Offline as Millions of Attacks Hit

Less than 48 hours after the disclosure of two critical vulnerabilities in PHP, the fallout is moving faster than anyone expected. Government services across the United Kingdom have been taken offline for emergency patching, the United States National Security Agency has advised operators to shut down systems that cannot be patched immediately, and security teams worldwide are reporting millions of hacking attempts as criminals race to exploit the flaws before defenses are in place. The incident, now known as PHP2Shell, has quickly escalated from a technical advisory into one of the most disruptive cybersecurity events in recent memory.

PHP powers roughly 70 percent of websites, according to a Cloudflare figure widely cited in coverage of the incident. The two vulnerabilities carry a severity score of 9.2 out of 10 on the CVSS scale, allowing remote code execution as well as reads of server memory. What makes the episode particularly notable is how the flaws were found: Ryan Austin of the security firm Calif discovered them with the help of GPT-5.6 Sol during an audit of PHP’s source code in August, in work funded by OpenAI. Google’s cybersecurity team Wiz independently found exploits, and Gemini 4 Argon was also used in the discovery work, according to AI Dispatch reporting that cites Reuters and Bloomberg. A bug class that had hidden in PHP’s source for years — previously judged too difficult to exploit — was cracked open by artificial intelligence in a matter of weeks.

The Last 24 Hours: What Changed

The timeline of PHP2Shell moved from quiet coordination to public emergency in less than three months. Here is how the critical events unfolded, based on reporting from Reuters, the BBC, Sky News, and other outlets covering the incident.

The compression of that timeline is the story. Coordinated vulnerability disclosures normally give operators weeks or months of breathing room between a fix and widespread exploitation. With PHP2Shell, the working group had been in motion since August 11 — yet within a day of the public release, attackers had already begun probing at scale, and institutions that normally keep their websites up at all costs were pulling the plug voluntarily.

Governments Go Dark: Who Took Sites Offline

The most striking image of October 22 was not a dashboard or a line of code. It was a growing list of government websites that simply were not there anymore — taken down by their own operators as a precaution against a flaw they could not patch fast enough.

In the United Kingdom, nearly three dozen government services went offline for emergency patching on October 22, according to multiple outlets. The disruption reached local councils including Oxford, Bristol, Lambeth, and Barnet, whose online services were interrupted as administrators scrambled to apply the PHP fixes. Even some BBC webpages were temporarily unavailable, a reminder that the vulnerability touches content management systems and web infrastructure far beyond classic “government IT.” The UK’s National Cyber Security Centre published a critical-warning notice on its own site about the flaws, and the British government launched an urgent probe into the country’s exposure — a formal acknowledgement that the patch gap could be measured not in days but in the number of services still running vulnerable code.

Voluntarily taking a public service offline is an extreme step, and it is one governments rarely take. Every hour a council site is down, residents cannot file forms, pay bills, or access services. The calculation being made in the UK was blunt: a site that is offline cannot be compromised, while a site left running on unpatched PHP might be silently owned by attackers within hours. When the choice is between a known, controlled outage and an unknown, possibly catastrophic breach, the outage wins.

Across the Atlantic, the US National Security Agency issued guidance in the same spirit: if systems cannot be patched immediately, take them offline. NSA guidance of this kind is rare and deliberately calibrated — the agency knows that telling organizations to shut down services is disruptive, which is precisely why it only says so when the risk of leaving them up is judged to be worse. The message lands especially hard on smaller organizations that lack dedicated security teams and may take days or weeks to apply patches they have not even heard of yet.

The government response sets this incident apart from routine vulnerability disclosures. Normally, patches are applied in the background of business-as-usual, and the public never notices. Here, the protective response itself became the news — because the protective response was to disappear from the internet entirely.

The Attack Wave: Millions of Hacking Attempts

While defenders were racing to patch, attackers were racing to exploit. Reuters reported on October 22 that companies and governments faced “millions of hacking attempts” tied to the PHP flaws as the disclosure triggered a frantic global patching scramble. The scale of the probing began almost immediately after the fixes went public — a pattern security professionals have come to expect, but rarely at this velocity or volume.

The speed of the attack wave traces back to a dynamic Thai Duong himself warned about before the disclosure: once a patch is released, the underlying vulnerability becomes visible to anyone willing to look. In his words, “Some dude on Twitter could take the patches and run AI against it and post some exploit script. All hell will break loose.” A patch diff is, in effect, a map to the vulnerability — it shows exactly which lines of code changed, and therefore exactly where the flaw was. Attackers have long used this reverse-engineering technique, but AI-assisted analysis now makes it dramatically faster. A working exploit derived from public patch data can be assembled, shared, and deployed at internet scale within hours.

Amazon reported detecting exploit attempts targeting its infrastructure, a signal that organized attackers were already testing the flaws against one of the largest cloud footprints on the planet. The fact that even hardened, well-defended targets were being probed suggests the attack wave was not limited to opportunistic scanning of small websites — it included deliberate attempts against major platforms where the payoff of a successful compromise would be enormous.

Wikipedia, meanwhile, took down some pages as a precautionary measure. The decision echoed the broader logic of the day: when a vulnerability of this severity is being actively probed, reducing your exposed surface — even temporarily — is a rational defensive move. Wikipedia’s move also underscored how widely PHP’s reach extends: the flaw does not just affect corporate websites and government portals, but the shared information infrastructure millions of people rely on daily.

Security analysts describe the current phase as the “exploitation window” — the period between public disclosure and the point at which most systems are patched. For most vulnerabilities, that window is quiet. For PHP2Shell, it has been deafening. Every hour that a vulnerable server remains reachable is an hour in which automated scanners, criminal botnets, and curious researchers are all knocking on the same door. The millions of attempts reported by Reuters are unlikely to be the peak; they are more likely the beginning of a curve that steepens as exploit code becomes more widely distributed.

What Security Leaders Are Saying Now

When the chief executives of the world’s largest technology companies start describing an incident in superlatives, it is worth paying attention. Microsoft CEO Satya Nadella said of PHP2Shell: “I’ve not seen anything like this in a long, long time.” Coming from the head of a company that operates one of the world’s largest cloud platforms and has weathered every major cyber crisis of the past decade, the comment signals how seriously the industry views the combination of the flaw’s severity, PHP’s ubiquity, and the speed at which AI-assisted discovery and AI-assisted exploitation are collapsing the old timelines.

Thai Duong, the Calif CEO who set the whole process in motion by alerting PHP’s security lead on August 11, had already framed the danger in stark terms before the disclosure. His warning — “Some dude on Twitter could take the patches and run AI against it and post some exploit script. All hell will break loose” — was not hypothetical. It described the exact mechanism now driving the attack wave: public patches plus AI analysis equals public exploits, fast. Duong’s comment captures the new reality that defenders face: the interval between “fix available” and “exploit everywhere” has shrunk from months to hours, and in some cases to minutes.

Alp Toker, a cyber expert at NetBlocks, told Sky News that the flaw is “highly impactful” and warned that the disruption could become “more widespread.” The phrasing matters. “Highly impactful” is a judgment about the vulnerability itself — its severity, its reach, the damage a successful exploit can do. “More widespread” is a judgment about the trajectory — an expectation that what we saw on October 22, with UK councils and BBC pages going dark, is the early edge of a larger pattern rather than the whole of it. As more organizations audit their exposure and more attackers weaponize the flaws, the geography and sector spread of disruptions is likely to grow.

Taken together, the three voices describe the same event from three angles: the institutional shock (Nadella), the technical mechanism driving the urgency (Duong), and the forecast for what comes next (Toker). None of them is predicting that the worst is over. The consensus is closer to the opposite: the disclosure was the starting gun, and the race is still being run.

Markets React to the AI Security Shock

The fallout did not stop at server rooms and government IT departments. On October 22, investors reacted to the PHP2Shell disclosure — and to what it implied about the security risks of the AI boom — by selling technology stocks aggressively. According to Reuters’ Trading Day coverage, investors’ AI fears “ramped up on Thursday,” and the Nasdaq fell 2.6% — its biggest single-day decline since June 5 — shedding roughly $1 trillion in market capitalization.

The logic of the selloff is worth unpacking. The vulnerabilities were discovered with the help of advanced AI models — GPT-5.6 Sol in Calif’s audit, Gemini 4 Argon in the discovery work, with Google’s Wiz team independently finding exploits. The same AI capabilities that found the flaws are now available, in some form, to the attackers building exploits from the public patches. Investors appear to have priced in a darker version of the AI story: not just AI as a productivity engine, but AI as an accelerant for cyberattacks against the infrastructure the entire digital economy runs on. A trillion dollars of market value evaporating in a day is the market’s way of saying the risk is systemic, not a single company’s problem.

There was, however, one clear beneficiary of the fear trade. The iShares Cybersecurity and Tech ETF rose on Thursday and is now up roughly 50% year-to-date, per Reuters’ Trading Day data. When a vulnerability this large breaks, money flows toward the companies paid to stop it. The ETF’s performance tells its own story about how the market expects this to play out: more spending on security, more demand for patching and monitoring tools, and a longer-term repricing of cyber risk across the software stack.

It is worth noting what the market reaction does and does not prove. A single-day selloff is not a verdict on the AI industry, and markets routinely overreact to headlines before the facts settle. But the scale of the move — the largest Nasdaq drop in more than four months — confirms that PHP2Shell has crossed from a technical story into a macroeconomic one. When a vulnerability can move a trillion dollars, it is no longer just an IT problem.

The AI Paradox: Found by AI, Now Raced by Attackers

PHP2Shell may be remembered less for the vulnerability itself than for what it revealed about the new economics of finding and exploiting software flaws. The discovery story is, by all accounts, remarkable. A class of bugs that had hidden in PHP’s source code for years — flaws that human auditors had effectively judged too difficult to exploit — was uncovered during an August audit by Ryan Austin of Calif, working with GPT-5.6 Sol, in an effort funded by OpenAI. Google’s Wiz cybersecurity team independently found exploits, and Gemini 4 Argon was also brought to bear on the discovery work, according to AI Dispatch reporting that cites Reuters and Bloomberg.

The most telling detail concerns the speed of the discovery. A Wiz researcher was able to accomplish in roughly a week what had previously taken teams of experts months of work. That compression ratio — months of expert labor reduced to a week of AI-assisted analysis — is the number that should focus every security leader’s attention. It means the cost of finding critical vulnerabilities has collapsed, and it has collapsed for everyone: defenders and attackers alike.

This is the paradox at the heart of the incident. AI found the flaws, which is good — better that researchers with AI discover them and coordinate fixes than that criminals discover them quietly and exploit them for years. But the same AI capabilities that compressed discovery from months to a week are now compressing exploitation from months to hours. The patch is public; the diff is public; and AI-assisted reverse engineering of that diff into a working exploit is available to anyone with a laptop and a model. The defenders’ advantage — responsible disclosure, coordinated patching, the August-to-October head start the working group enjoyed — is real but shrinking with every cycle.

There is a broader implication that extends well beyond PHP. If AI can find a years-hidden critical bug class in one of the most audited open-source codebases on the planet, it can find similar flaws in the countless less-scrutinized systems the internet depends on. Security teams have long operated on the assumption that deep, subtle vulnerabilities are rare and expensive to find. PHP2Shell suggests that assumption is expiring. The next question is not whether more AI-found flaws like this will surface — it is how many, how fast, and whether the patching infrastructure of the web can keep up with the discovery infrastructure that AI has just handed to both sides.

Patch vs. Firewall vs. Going Offline: Your Options Compared

With the exploitation window open and attack volume climbing, website operators face a practical question: what is the fastest way to get safe? There are three broad strategies, each with different tradeoffs. The right choice depends on your infrastructure, your team’s capacity, and how exposed your systems are right now.

A few points of clarification on the comparison. Patching is the only option that actually resolves the vulnerability; everything else is containment. Firewall rules are a valuable speed bump — they can be deployed in minutes and will stop the most common automated exploit attempts — but they are pattern-matching defenses against an adversary that is actively evolving its patterns with AI assistance. Taking a site offline is the bluntest instrument available, and the fact that it is being seriously recommended by the NSA and voluntarily chosen by UK government services tells you everything about how the risk is being assessed by people with full information.

In practice, the strongest posture is layered: firewall rules immediately, the official patch as fast as safely possible, and offline as the fallback for anything that cannot be patched on a short timeline. Yesterday’s deeper guide on this site covered the full six-step protection playbook in detail; what follows is the compressed version for operators who need to act in the next 24 hours.

What Website Owners Should Do in the Next 24 Hours

If you run a website — especially on shared hosting, a VPS, or any stack where PHP is in the mix — treat the next 24 hours as the window that matters most. Here are the concrete steps, in priority order:

1. Find out your PHP version right now. Check your hosting control panel, run php -v on your server, or ask your host. You cannot assess your exposure until you know what you are running. If your host has already patched or auto-updated, confirm it rather than assuming it.
2. Apply the official PHP Foundation patch immediately. This is the single most important action. If your host manages PHP for you, open a ticket or check their status page to confirm the patched version is deployed on your server. Do not wait for a maintenance window.
3. Put firewall rules in front of everything while you patch. If you use Cloudflare, Sucuri, or another WAF, make sure PHP-focused exploit rules are active. This is mitigation, not a cure — but it meaningfully reduces your exposure to automated mass-exploitation during the hours before your patch lands.
4. Check for signs of prior compromise. Review access logs for unusual requests, look for unfamiliar files or processes, and check whether any unexpected admin accounts or scheduled tasks have appeared. With a remote-code-execution flaw being probed at this scale, assume that unpatched systems reachable from the internet may already have been touched.
5. Seriously consider temporary offline or maintenance mode for anything you cannot patch today. This is the NSA’s guidance, and it is the same call UK government services made. A static maintenance page is infinitely better than a compromised server.
6. Read the full protection guide. Yesterday’s article on this site walked through the complete six-step hardening playbook — backup verification, patch validation, log review, credential rotation, and longer-term monitoring. If you have handled the five steps above, work through that guide next to close out the remaining gaps.

Frequently Asked Questions

Is my WordPress site affected?

WordPress itself runs on PHP, so any WordPress site is in the blast radius if the underlying PHP version on its server is vulnerable. The practical question is not whether you use WordPress but which PHP version your hosting environment runs. Contact your host or check your Site Health panel (Tools → Site Health → Info → Server) to see the PHP version. If your host has applied the PHP Foundation’s patches, you are covered at the language level; keep WordPress core, themes, and plugins updated as well, since attackers probing PHP flaws will also try every other door. Managed WordPress hosts have generally patched quickly, but verify rather than assume — especially on shared or budget hosting.

How do I know if I’m patched?

Compare your running PHP version against the fixed versions announced by the PHP Foundation in its security release. Your hosting provider’s status page or support team should confirm which patched version is deployed on your server. If you manage your own server, update through your package manager or official PHP builds and then verify with php -v that the new version is actually the one serving your site — a common mistake is updating the CLI binary while the web server still loads the old one. After patching, restart your web server and PHP-FPM (or equivalent) to make sure the fixed code is live, and re-check the version reported by your application.

What did the NSA actually advise?

The US National Security Agency advised organizations to take systems offline if they cannot be patched immediately. That is a significant escalation from the usual guidance, which is simply “patch promptly.” The NSA’s recommendation acknowledges a reality of this incident: with millions of hacking attempts underway and exploit code spreading, an unpatched internet-facing system is not merely at risk in theory — it is an active target right now. Taking a system offline is disruptive, and the NSA would not recommend it lightly; the advice reflects a judgment that the risk of compromise outweighs the cost of downtime for systems that cannot be secured quickly.

Could attackers really exploit this at scale?

The evidence from the last 24 hours says yes. Reuters reported millions of hacking attempts as the disclosure triggered a global patching scramble, Amazon detected exploit attempts against its infrastructure, and the speed of weaponization follows a well-understood pattern: once patches are public, the vulnerability is effectively public too, and AI-assisted analysis is making exploit development faster than ever. Thai Duong’s pre-disclosure warning — that someone could take the patches, run AI against them, and publish a working exploit script — describes exactly the dynamic now in motion. Mass scanning of the entire internet for vulnerable servers is cheap and automated; the question was never whether attackers would try at scale, but how fast. The answer, it turns out, was within hours.

Will there be more AI-found flaws like this?

Almost certainly. The discovery story behind PHP2Shell — a bug class hidden in PHP’s source for years, judged too hard to exploit, found in weeks with AI assistance, with a Wiz researcher compressing months of expert work into about a week — is not an anomaly. It is a demonstration of a new capability that is now generally available. The same AI-assisted auditing techniques can be pointed at any large codebase, and both researchers and attackers have every incentive to do so. Expect a future in which critical vulnerabilities are found faster, disclosed more often, and exploited more quickly — and in which the organizations that survive are the ones that patch fastest. The strategic lesson of PHP2Shell is not just “update PHP.” It is that the discovery-to-exploitation cycle has permanently accelerated, and defensive timelines need to accelerate with it.

The Bottom Line

Twenty-four hours after disclosure, PHP2Shell has already forced governments offline, triggered millions of hacking attempts, drawn rare shutdown guidance from the NSA, wiped roughly $1 trillion from the Nasdaq, and prompted the Microsoft CEO to say he has not seen anything like it in a long, long time. The vulnerability is severe, the affected software is everywhere, and AI has compressed both discovery and exploitation into timelines the industry’s old playbooks were not built for.

But the situation is not hopeless — it is urgent. The fixes exist, they are published, and applying them is the single action that ends the risk for any given system. Firewall rules buy time. Going offline buys safety. What buys neither is waiting: every hour of delay is an hour in which automated attackers are testing your door. Patch now, verify the patch, check your logs, and treat the next 24 hours as the window that decides whether this story ends as a close call or a catastrophe. The AI era of cybersecurity has arrived ahead of schedule — and it is moving at machine speed.