AI found hidden flaws in the Internet
AI found two hidden flaws in the software behind most websites. Hackers pounced within hours. What Caribbean businesses and individuals should do now.
On 21 October 2026, the world learned of two serious flaws in PHP, the software that builds about 70 percent of websites. Security researchers found them with help from AI. The flaws, nicknamed PHP2Shell, let a stranger take control of the computer behind a website without a password. A fix is out, but attackers tried the flaws millions of times within hours, and governments and companies from the Netherlands to Japan switched websites off to stay safe. This guide explains what happened and what to do, in plain language.
Part 1 of 6AI spotted what human experts missed for a decade
Think of PHP as the kitchen behind a website. You see the dining room: the menu, the photos, the booking form. PHP works in the back, cooking each page the moment you ask for it. WordPress, which runs about 40 percent of all websites according to Reuters, is built on PHP. So are Drupal and Joomla.
In August, two security teams found a serious fault in that kitchen. The AI security firm Calif got there first, on 1 August, using OpenAI's GPT-5.6 Sol, Fortune reports. Wiz, a security company owned by Google, found it on its own on 19 August using Google's Gemini 4 Argon and GPT-5.6 Sol, and told the PHP team on 24 August.
For the next two months, a group including OpenAI, the PHP Foundation, Wiz, Calif, Cloudflare and US government agencies prepared a fix in secret. Details leaked online on 20 October, so the fix came out a day early, on 21 October. The fault had gone unnoticed for about ten years.
“With frontier AI models and the right tools, a single researcher completed in a week”
Wiz researchers, describing work they said was at the edge of human capability, as reported by CNN
Why it matters
People had read this code for years and missed the danger. Greg Brockman, OpenAI's president, told Fortune that a small version of the problem was spotted in 2024 and dismissed. AI looked again and saw how the pieces fit together.
This time the defenders found it first, by about two months. Next time, attackers using the same AI tools could get there first, and the first sign would be a break-in.
Part 2 of 6How PHP2Shell works: a kitchen that never clears the counter
Every time someone visits a website, PHP takes the order, cooks the page, then clears up for the next customer.
The flaw is in the clearing up. If an order goes badly wrong, for example if the kitchen runs out of memory halfway through, PHP abandons it but leaves a mess on the counter. The next order picks up that mess. An attacker can cause the mess on purpose, then use it to slip their own instructions into the kitchen.
Security experts call this remote code execution: a stranger on the internet makes your server, the computer that hosts your website, do whatever they want. The PHP team rated both flaws 9.2 out of 10 for severity. Their official labels are CVE-2026-109618 and CVE-2026-109619, the ID numbers security teams use to track a flaw.
Why it matters
The danger does not come from your website's own design. Wiz broke into the latest, properly set-up versions of WordPress, Drupal and Joomla, so a well-run site was exposed until PHP itself was fixed.
Once inside, attackers can read information held in the server's memory, Wiz says, and David Nicol of the University of Illinois told Fortune the flaws can open a door into the wider network. That is why the PHP Foundation told site owners to install the fix immediately or take their sites offline, according to Fortune.
Part 3 of 6Hackers moved within hours and websites around the world went dark
Cloudflare, which protects a large share of the world's websites, watched the attacks arrive. Its chief executive, Matthew Prince, said it saw thousands of attempts in the ten hours before the announcement, tens of thousands in the first 45 minutes after it and millions by that evening, ABC News reported. Amazon Web Services said the flaw was being broadly exploited.
Many organizations switched off rather than take the risk. According to CNN, government websites in France, Denmark, Finland and the Netherlands went down for a time, nearly three dozen UK government services were unavailable, and in Japan the airline ANA, the railway JR West and the bank MUFG suspended some services. Wikipedia's owner took several systems down as a precaution. Palo Alto Networks counted about 22.6 million systems that could be at risk, Fortune reported.
“I've not seen anything like this in a long, long time”
Satya Nadella, chief executive of Microsoft, as reported by ABC News
Why it matters
The time between a fix appearing and criminals using the flaw has shrunk to hours. A business that waits for its usual monthly update is already behind. Japan's prime minister, Sanae Takaichi, posted a plain request on X: “Please check if your publicly available websites use PHP.”
Taking a site offline costs money, whether it is a ministry that cannot accept applications or a hotel that cannot take bookings. A break-in that leaks customer data costs far more.
Part 4 of 6Why a WordPress website in Kingston is exposed too
Most website owners never think about PHP. They see WordPress, a ministry portal or a school's learning platform, while PHP runs underneath all of them, like the foundation of a house: out of sight until it cracks.
That is the uncomfortable part of PHP2Shell. A website can be well built and still be at risk, because the weakness is in the layer beneath it.
Why it matters
As of 22 October, we found no public reports of Caribbean websites being knocked offline or broken into. That is not the same as being safe. Treat any site running WordPress, Drupal, Joomla or custom PHP code as exposed until someone confirms PHP has been updated.
The region's biggest weak spot is the forgotten website: built years ago by an outside designer, then left alone. Tourism boards, churches, sports clubs and small hotels may not know who manages their hosting. Those are the sites attackers look for first.
Part 5 of 6Five things every business with a website should do this week
The PHP team says only the update fully fixes the problem. The safe versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer get official fixes, so those sites need an upgrade, or a repair from their software supplier.
- Make a list. Write down every website, booking system, payment page and internal tool you run, including any built by outside agencies, and find out which ones use PHP.
- Update, then restart. Install the safe version, restart the server and check that the new version number is the one running.
- Ask your hosting company. If someone else runs your website, ask them in writing whether PHP has been updated, and when.
- Protect what you cannot fix today. Put the site behind a web firewall, a filter such as Cloudflare that blocks attack traffic before it reaches you, or take it offline. The PHP team lists temporary settings for technical staff, but they lower the risk without removing it.
- Check for a break-in. Ask your technical team to look for new or strange files in upload folders, new user accounts and unusual traffic leaving the server, as the security firm Check Point advises.
Why it matters
Banks, insurers, utilities and government agencies hold the data criminals want most. Their boards should ask one question today: has every public-facing PHP system been updated, and who signed off on it?
If you suspect a break-in, report it to your national response team, such as TT-CSIRT in Trinidad and Tobago. The US agency CISA and Singapore's Cyber Security Agency issued urgent alerts, and their advice applies in the Caribbean too.
Part 6 of 6AI now works for both the locksmith and the burglar
The same AI that found PHP2Shell can help criminals. OpenAI warned that these capabilities “can also help attackers rapidly develop offensive tools and exploits,” Fortune reported.
Think of AI as a master key-cutter that anyone can hire. A locksmith uses it to find weak locks and fix them. A burglar uses it to cut keys faster. Flaws that hid for a decade can now be found in weeks, and turned into working attacks within hours of becoming public.
“It marks an AI inflection point.”
Wiz, in its blog post on PHP2Shell
Why it matters
Many Caribbean organizations rely on small IT teams or outside contractors. The time they have to react has shrunk much faster than their staff has grown. Updating software quickly has moved from a chore for later to the main defence.
The same tools are open to the region's defenders. Caribbean security teams, universities and young developers can use AI to check local systems before attackers do.
What individuals need to know about PHP2Shell
- Stay calm if a website is down. Ministry, bank or booking sites may go offline for a few hours while they are repaired. That usually means the owner is being careful.
- Hang up on anyone offering to fix the “PHP virus”. The flaw affects the computers that host websites. Nothing on your phone or laptop needs fixing, so any call, text or email offering to fix it is a scam.
- Use a different password for every account. If a site you use reports a break-in, change that password straight away. A password manager makes this easy.
- Turn on two-step verification. A code sent to your phone protects your email, bank and social media accounts even if a password is stolen.
- Run a small website? Ask your host today. Bloggers, churches, small shops and clubs on WordPress should ask their hosting company, in writing, whether PHP has been updated.
The PHP2Shell lesson for the Caribbean
Questions readers ask about PHP2Shell
The 9 sources behind this article
- PHP project, security advisory on the two remote code execution flaws, 21 October 2026
- Wiz, PHP2Shell research post, 21 October 2026
- Fortune, "AI helped discover the PHP vulnerability that could take down 70% of the internet," 21 October 2026
- CNN via Caribbean Broadcasting Corporation, "Websites shut down globally after AI finds cybersecurity flaw," 22 October 2026
- ABC News (Australia), "Hacking attempts surge as websites race to patch PHP issues," 23 October 2026
- Check Point, "PHP2Shell: what we know about the leaked PHP vulnerabilities," October 2026
- CISA, alert on PHP vulnerabilities requiring immediate patching, 21 October 2026
- Cyber Security Agency of Singapore, alert AL-2026-151 on PHP2Shell
- TT-CSIRT, Trinidad and Tobago Cyber Security Incident Response Team