AI Found a Key to 70% of the Web. Someone Tried It 4 Days Early.

On October 21, the people who look after PHP, the language behind about 70% of the world's websites, shipped a fix for two critical flaws that a researcher working with AI had found in August. Within hours, governments started switching their sites off. And Amazon later said someone had already tried the flaw on one of its decoy servers four days before the world was told. We turned the story into a 37-second film. Watch it on this page, or as a YouTube Short.

The key that still works

IBM's Patrick Fussell gave CNN the simplest picture of it: "Think of a hotel room where you check out, but your key still works." The two flaws, CVE-2026-109618 and CVE-2026-109619, are memory-safety bugs in how PHP handles a request that ends badly, especially one that runs out of memory. Wiz, the security firm that found them, says the crash can leave "a corrupted internal PHP state behind," and a later request can reuse it. That can let an attacker run code on the server or read memory that "may contain passwords, authentication tokens, API keys and certificates."

Wiz rates both at CVSS 9.2 out of 10. It says every PHP version of the last decade is affected by at least one of them, going back to PHP 5.4.

What AI changed

Wiz Research found the first flaw on August 19 and reported both to the PHP security team on August 24. It says it used its own Wiz Atlas tool with Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol throughout. Turning the bug into a working attack meant chaining several flaws and adapting to each target's memory layout, and the AI models made that practical "in hours" per application. Its summary: "a single researcher completed in a week what previously would have taken a world-class team months of work."

Three things to take from it

The lights went off

Once the fix was public, website owners raced to patch, and many took sites offline first. In France, the Interior Ministry put all of its websites into maintenance. Denmark's municipal IT company Kombit shut several services, including the national school platform. Finland's state IT provider Valtori took government network services offline. In the Netherlands, the National Cyber Security Centre, the Port of Rotterdam and the government portal went down. CNN reported that Japan's largest bank, MUFG, the airline ANA and the railway JR West were affected, along with nearly three dozen UK government services.

Cloudflare's network saw millions of attempts to exploit the flaws in the following days. According to Censys data cited by Reuters, about 1.5 million out of 2.6 million hosts report a PHP version for which there is no fix.

Four days early

Amazon's threat intelligence team said its MadPot decoy network recorded an exploitation attempt on October 17, four days before public disclosure, from an IP address tied to a commercial anonymization service. It now says PHP2Shell "is now seeing broad exploitation attempts in the wild."

Why a finance team should care

I run AI on real finance work, and this is the week the timeline changed. Payment portals, supplier sites, booking platforms and utility portals are often built on PHP, and some of them hold card details. The old comfort was that finding a flaw this deep took a world-class team months, which gave defenders time. If one researcher with AI can do it in a week, plan as if someone else can too.

Three questions are worth asking on Monday. Which of our public sites and vendor portals run PHP? Are they on the October 21 release? And who checks that our critical suppliers have patched?

The fine print

The 70% is the share of websites that use PHP, not a count of sites that can be broken into. Fussell told CNN that a real attack "requires a couple of conditions that are actually fairly complex," so not every PHP site is exposed in the same way. Amazon has not said who was behind the early attempt, and the film's hotel and city are an illustration, not footage of a real attack.

The bottom line

AI made a months-long hunt into a week. Patch first, then ask your suppliers the same question, because the next flaw will be found faster than this one.

Where the numbers come from

Wiz Research, PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet, October 21, 2026. Amazon Threat Intelligence, PHP2Shell exploitation prior to public disclosure in MadPot, October 21, 2026, updated October 22. CNN, Websites shut down globally after AI finds cybersecurity flaw affecting 70% of the internet, October 21, 2026. Reuters, Government websites go dark after AI-discovered flaw sparks security scramble, October 21, 2026. All checked on October 23, 2026.

Wiz, Amazon, Cloudflare, IBM and the PHP project are not involved in this film.