An AI found a 14-year-old hole in PHP. Australian government sites went dark for a night. The PHP nobody can patch is the part that lasts.

At 14:00 UTC on Wednesday 21 October, the PHP project released the fix for two critical holes in the language under a big share of the web. In Sydney, that was 1am on Thursday.

By then Australian government sites had been coming down since the evening, ASD's own cyber.gov.au among them. A spokesperson for Home Affairs Minister Tony Burke said the National Office of Cyber Security was aware of "disruptions to several Australian websites on the evening of October 21" (The Canberra Times, 2026).

If PHP is a word you've only seen in job ads, it's the server-side runtime under WordPress, Drupal, Joomla, Moodle, Magento and Laravel. It's also under GovCMS, which iTWire describes as "the Drupal platform behind a big chunk of Australia's federal web presence" (iTWire, 2026). OpenAI and Wiz both use 70 per cent without saying where it comes from. W3Techs, which does, put it at 69.2 per cent of the sites whose server-side language it can identify on 29 October (W3Techs, 2026).

Most coverage led with the AI angle. It's a real story, but if you run a website, the clock and the version numbers matter more: the clock put Australia's working day inside the gap between knowing and fixing, and the version numbers mean a lot of production PHP has no fix from the PHP project to install.

On Friday I wrote about Commonwealth agencies being told to stocktake their legacy technology. This is what that deadline looks like when it turns up early.

Related Article18 min read

OpenAI's agents reached five Australian government sites. Kwon says the way in was 'not super-sophisticated'. That's the bad news.

OpenAI's agents reached five Australian government bodies in June. The ways in were configuration and age, not zero-days, and Services Australia...

Read full article

What PHP2Shell actually is

Two bugs, one name: "RCE via OOM corruption" (CVE-2026-109618) and "RCE via stale global state" (CVE-2026-109619), in php.net's words (php.net, 2026). If PHP runs out of memory or hits a fatal error at exactly the wrong moment, it can leave half-built or already-freed data lying around. The next request trusts that leftover data, and a careful attacker can turn that into running code on your server without logging in.

php.net's list of who's at risk is short: "all PHP installations serving web requests". It rates mod_php highest, where an unauthenticated request can trigger the attack "before any application code runs." The flaw's in the runtime, so updating WordPress or a plugin won't touch it.

PHP rates both bugs 9.2 Critical on CVSS v4.0, but the vector carries high attack complexity and attack prerequisites (AC:H and AT:P) (GitHub, 2026). NVD scores the first 9.8 Critical and the second 8.1 High (NVD, 2026). Serious, then, but harder to pull off than a bare 9.8 suggests.

And old. Calif, which reported it first, says "the earliest affected path we found dates to PHP 5.4.0", a March 2012 release. That's where OpenAI president Greg Brockman's line comes from: "The bug has been present in PHP for 14 years," he wrote within an hour of the release (Brockman, 2026). The PHP Foundation says a core developer found the first signs of the out-of-memory problem in 2024, while fixing an issue from a Quarkslab audit, and the fix then stalled. Its verdict: "We won't pretend otherwise: the delay was a structural failure, caused by both the security team's decision process and its lack of resources" (PHP Foundation, 2026). That's rare candour, and I respect it. It was also up to two years.

Who found it, and what they say the AI did

The credits are crowded. Going by the PHP Foundation, Calif began auditing PHP on 30 July under OpenAI's Patch the Planet programme and reported "an unconditional remote code execution" on 11 August. OpenAI independently reported the same root cause, then further attack vectors on 18 September. Wiz says it found its first bug on 19 August and reported on 24 August (Wiz, 2026). Their accounts of what the AI did don't quite line up.

OpenAI: "Calif identified a critical flaw using GPT-5.6 Sol as part of our Patch the Planet initiative, with Wiz also independently discovering and reporting both vulnerabilities" (OpenAI, 2026).

Calif's own write-up, by Ryan Austin, doesn't name a model. "I asked my LLM companion for help," it says, and "No special harness, or access to models that weren't generally available to everyone were used in the initial bug discovery." Its closing line belongs above every AI security pitch I'm sent: "No model is simply capable of unearthing 'all bugs' with simple prompts. At least for now" (Calif, 2026).

Wiz: "We used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol throughout this research." It also claims that "a single researcher completed in a week what previously would have taken a world-class team months of work."

OpenAI

@OpenAI

OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.

Over the past two months, we led a coalition of maintainers, researchers,

14.5K

21 Oct 2026

I won't referee the credit. The most modest account comes from the researcher who started the hunt.

What matters to a site owner is the pace. The Foundation says its security team has published 15 CVEs since 1 July and waded through more than 100 invalid, duplicate or unreproducible reports. OpenAI says it expects "similar findings to increase sharply in the coming months". If it's right, this week happens again.

In August I wrote about agents breaking into systems nobody asked them to touch. Patch the Planet aims the same capability on purpose.

Related Article16 min read

AI agents broke into Hugging Face and a Melbourne gym. Nobody asked them to.

An OpenAI model spent four and a half days breaking into Hugging Face's systems to cheat a benchmark. A Melbourne agent cancelled a stranger's...

Read full article

The day before the patch

Times are Sydney time, UTC in brackets.

On Saturday 17 October, Amazon's MadPot honeypots logged a PHP2Shell exploitation attempt "four days before public disclosure", from an address on a commercial anonymisation network (Amazon, 2026).

At about 2am on Wednesday 21 October (15:00 UTC on the 20th), the CVE IDs began circulating online, though "No technical details leaked," the Foundation says. PHP published its pre-announcement at 6:30am. OpenAI's Clint Gibler wrote that "We were intending for the patch to go live Thursday", but "the PHP maintainers pulled the patch release up a day" (tl;dr sec, 2026). Thursday's slot would have been 1am Friday here. Around 7am, Calif "mistakenly published a video" of its proof of concept, which the Foundation says "contributed to accelerated development of various PoCs". (I'm not linking it.)

From about 1pm (02:00 UTC), Amazon saw multiple proof-of-concept exploits, and attempts varied enough to suggest "multiple actors". Cloudflare's default WAF rules went live at 2:02pm. At 6:41pm (07:41 UTC), the Foundation says, Chainguard "unilaterally broke the embargo and published built images containing the fix", more than six hours early. The release landed at 1am Thursday, and the Foundation "did not identify any functional exploits at the time of release/public disclosure."

Cloudflare

@Cloudflare

Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed data from reaching attackers.

7K

21 Oct 2026

So Australia's whole Wednesday sat between knowing something critical was coming and having the fix in hand. Central Europe got the fix at 4pm the same day, and New York at 10am. We got it at 1am. Anyone in Sydney deciding whether to pull a site made that call with the patch hours away and a leaked video already feeding proof-of-concept code.

You can read the same clock the other way: a full day's warning, Cloudflare's rules by mid-afternoon, and a release at the one hour a web team might pick to patch a fleet. I'd take that reading, on one condition. The day's only useful if you can spend it on an inventory you already have. The sites that came down weren't casualties of the hour. They were the ones nobody could vouch for by 9pm.

The Australian night

ASD's first post went up at 2:56pm on Wednesday, saying it was aware of media reporting about critical vulnerabilities in PHP "that may affect all versions from PHP 5 onwards". Its ACSC published a Critical alert the same day, before the release. The page still says the details would be "publicly announced on Thursday 22 October 2026 at 0100 AEDT" (ASD's ACSC, 2026).

iTWire's summary: "That night, cyber.gov.au and other federal sites went dark." Burke's spokesperson told the ABC some websites were "temporarily unavailable as work is undertaken to mitigate risks arising from this vulnerability" (ABC News, 2026). ASD's own outage post went up at 9:02pm, about four hours before the fix landed.

Australian Signals Directorate

@ASDGovAu

We are aware of an outage that may be affecting Government websites, including cyber.gov.au.

Organisations and individuals using PHP within their environments should monitor and review PHP official guidance, and apply security patches as they become available.

18

21 Oct 2026

On Thursday morning, with the fix out, Information Age found the ABS and Jobs and Skills Australia sites unavailable, and both came back soon after (Information Age, 2026). The Canberra Times reported that the ATO, Health Department and ACMA sites "also appeared to be temporarily affected on Thursday", and that the Parliament of Australia site was down at one stage with a maintenance message.

The NSW Government's 22 October statement said: "As a precaution, some NSW Government websites have been temporarily taken down while work to apply patches and updates is completed." It added that "to date no NSW Government agencies have reported any information breaches to Cyber Security NSW" (NSW Government, 2026).

The ABC's Cam Wilson reported that GovCMS "blocked direct access to its servers while keeping cached copies of public pages available", that Moodle took its own website offline as a precaution, and that VentraIP restricted some file uploads on customer hosting (ABC News, 2026).

The ACSC's wording has since narrowed. Information Age quoted the alert on 22 October as "not aware of active exploitation related to these vulnerabilities". The page, last reviewed on 22 October, now says: "ASD's ACSC is not aware of successful active exploitation within Australia, related to these vulnerabilities." If you're briefing anyone, quote the current one with its date.

None of this was unusual. The ABC reported government sites in the Netherlands, Finland and France going offline ahead of the fix. Japan's Prime Minister Sanae Takaichi said that for anyone who couldn't patch promptly, "temporarily suspending websites and similar measures can be considered an effective way to reduce risk" (AP, 2026). Troy Hunt's version on ABC News Breakfast was the shortest: "You have to patch it very, very quickly, or the suggestion is to take it offline" (ABC News, 2026).

What the exploitation record shows so far

On Friday morning, a day after telling ABC viewers to patch or pull the site, Troy Hunt asked the next question.

Troy Hunt

@troyhunt

Have we seen any documented breaches / exploitation traced back to either PHP2Shell or the eMudhra debacle? Massive headlines this week, what’s the impact so far (other than all the scrambling to patch etc)?

463

22 Oct 2026

The sharp version of that question goes further: more than a week on there's no confirmed Australian breach, the attack's complex, NVD rates one bug High rather than Critical, and pulling sites was an overreaction. I don't accept it, but the record deserves a straight reading.

Amazon says "it's unclear if any of these attempts would have succeeded in real-world systems." Cloudflare "observed attack traffic targeting our customers" and saw attackers "mutating the attack payload to try to bypass our protections." CISA added both CVEs to its Known Exploited Vulnerabilities catalogue on 26 October (CISA, 2026). Wiz calls Adel Karimi's honeypot exploitation "a likely contributing factor" to that, and rates his report the best public evidence it's seen, with a caveat: the targets ran a single-worker Apache mod_php setup that suited the attack.

Wiz's 27 October update said: "We have not yet observed successful end-to-end PHP2Shell exploitation in our own telemetry." It also said that a week after disclosure, less than 53% of the initially affected organisations in its own scan data were still vulnerable (Wiz, 2026).

So a week in, it's mostly scanning and attempts, plus one public report of success on a setup that favoured the attacker. That's the point at which I'd expect the servers nobody can patch to become the easy targets. And nothing on the public record that night said any of this. They had a Critical alert, a release that hadn't shipped and a leaked video turning into code. What they did with it cost hours of availability and no data: cached pages, blocked uploads, a maintenance notice. RUSI's James Sullivan told AP that taking sites offline while fixing the problem is "good practice". I agree, as long as somebody's allowed to make that call at 11pm.

The PHP nobody can patch

This is the part that'll still be true in March.

php.net: "PHP 8.1 and older no longer receive updates from the PHP project." The security team provided "minimal source-backports" for 7.4, 8.0 and 8.1, but no compiled builds, and anything older gets nothing. php.net adds that "Some distributions and LTS vendors provide backported fixes, so contact your vendor for details", so for 8.1 and older the fix exists only if someone else builds it for you. W3Techs counts 26.5% of PHP sites on PHP 7 and 7.7% on PHP 5, and none of them got a build from the project. None of that is new either; 7.4 left support at the end of 2022. What's new is a 9.2 that reaches it. Laravel's note to Vapor customers says it in one line: "If you're running PHP 8.0, or 8.1 no patch is available" (Laravel, 2026). And 8.2, the oldest branch that did get a fix, "reaches end of life on 31 December 2026".

Picture a council events microsite, built on WordPress in 2019, on shared hosting at PHP 7.4 because a plugin broke the last time someone tried 8.x. Nobody at the council's going to compile PHP. Whether the fix ever reaches that server depends on the host, a distribution vendor or an enterprise long-term support provider, which is where WP Engine says its patches came from (WP Engine, 2026).

PSPF Direction 002-2026 gives every non-corporate Commonwealth entity until the end of March 2027 to finish a legacy technology stocktake, and the Systems of Government Significance tranche has to be done first, by 31 December (PSPF, 2026). PHP2Shell is what the stocktake looks like when the deadline arrives before the spreadsheet does.

Fully patched has a shelf life, too. On 23 October php.net flagged a third bug, CVE-2026-115560 in session upload progress, and told users to set session.upload_progress.enabled=0 "until the next regular bugfix release, to fully protect from an unlikely RCE vector." It needs an unusual configuration to bite, but Cloudflare notes it affects fully patched releases, including 8.5.12. As at 29 October, a release carrying that fix hadn't shipped.

Cloudflare had default rules live before disclosure, free plan included, but a WAF rule isn't a patch, and Cloudflare's own post tells customers to patch anyway (Cloudflare, 2026). php.net says its own stopgaps "reduce exposure to specific attack paths but do not make an installation safe."

In September I wrote about Cloudflare's new AI crawler defaults. Default WAF rules are the same habit applied to security, for better and worse.

Related Article11 min read

Cloudflare's AI training block also blocks Googlebot. That isn't a bug, and on Tuesday it becomes the default.

Cloudflare's new AI crawler defaults land on Tuesday. Blocking Training can block Googlebot with it, and that's documented design rather than a fault.

Read full article

What to check before lunch

Seven checks, roughly in the order I'd do them.

1. List every PHP runtime you're responsible for. The main site, the microsites, the Moodle, the agency subdomain on GovCMS, the campaign site nobody remembers. For anything hosted, ask the host in writing which PHP version serves it and when it was patched. AISA's Scarlett McDermott put it plainly: "If you don't know what software you're running, you can't know whether you're vulnerable" (Information Age, 2026).
2. Compare against the fixed versions. Anything below 8.2.35, 8.3.36, 8.4.27 or 8.5.12 isn't patched. Anything on 8.1 or older gets no compiled build from upstream, so ask the host or distribution which backport they shipped, and give it a migration date rather than a ticket. (Tickets for unfixable things tend to live forever.)
3. Turn off session upload progress unless something actually uses it. Set it in php.ini or the pool config and restart the workers, then check again when the next release lands.
4. Treat WAF rules as a layer. Keep them on, and don't close the ticket because of them.
5. Read your logs from 17 October, not 21 October. That's Amazon's advice. Wiz suggests looking for unusual multipart requests followed by memory-limit errors or repeated HTTP 500s, very large or malformed PHPSESSID cookies, and unexplained PHP worker churn.
6. Write down who can take a site offline. The NSW Government and France's Interior Ministry both did it within a day, and Japan's Prime Minister told anyone who couldn't patch promptly to consider it. If the one person who can make that call is on leave and nobody else is named, you've found your gap.
7. Assume it repeats. Patch the Planet takes applications from open-source projects, so the next target's already in someone's queue.

The FBI's version, two days after the release, is the one I'd forward to a client who doesn't know what PHP is.

FBI

@FBI

The FBI continues to warn about two critical security flaws in PHP, a programming language used to build many websites and online services. Attackers could exploit these vulnerabilities to break into systems, putting sensitive information and business operations at risk. Security

4.9K

23 Oct 2026

Back to the clock

The next critical fix will land at whatever hour suits the maintainers, and some of those hours will be 1am in Sydney. The difference between pulling a site for a night on your own terms and hearing about your exposure from a stranger is whether anyone could answer the first question on that list before it was asked.

I don't know how much PHP across Commonwealth agencies is still on 8.1 or older, or how much will be stranded on 8.2 after 31 December. The stocktakes that would tell us are due by the end of March.

For the record, the PHP Foundation says it scanned PHP with Anthropic's Claude Mythos earlier this year and thanks Anthropic, among others, for tool access and funding. Claude isn't credited with finding these bugs. Usual disclosure: we use Claude every day at Webcoda, and this site's tooling is built on it. Factor that in.

Key takeaways

• PHP2Shell is two critical bugs in the PHP runtime, CVE-2026-109618 and CVE-2026-109619, fixed in 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Updating WordPress, Drupal or a plugin won't fix them.
• The fix landed at 1am Sydney time on 22 October, after government sites had started going offline.
• PHP 8.1 and older get no compiled fix, only minimal source backports for 7.4, 8.0 and 8.1. PHP 8.2 reaches end of life on 31 December 2026.
• A third bug, CVE-2026-115560, affects fully patched releases. Set session.upload_progress.enabled=0 until the next regular release, which hadn't shipped as at 29 October.
• A week in, the record shows scanning and attempts plus one public report of success on a setup that favoured the attacker. ASD's ACSC isn't aware of successful active exploitation within Australia.
• OpenAI credits GPT-5.6 Sol, Calif names no model, and Wiz credits several, Gemini 4 Argon among them. Whoever gets the credit, this'll happen again.

---