Governments and corporations spent the weekend patching two critical flaws in PHP, with some cybersecurity professionals calling the episode 'Black October', CybersecAsia has reported, citing CNBC News.

The two flaws

The bugs, tracked as CVE-2026-109618 and CVE-2026-109619 and known together as PHP2Shell, can let attackers run code on a server without logging in. The PHP Foundation released fixes on 21 October 2026 for versions 8.2 through 8.5, and in the US the FBI issued a public service announcement on 23 October saying security updates were available and should be applied immediately.

The NSA, FBI and CISA urged organisations to patch immediately and to take systems offline if they could not. The NSA said the vulnerabilities often provide a direct path to a server's file system or database. Government websites in Britain, Finland and Japan experienced outages or reduced service during the response, as administrators restricted access while they investigated exposure.

How the flaws were found

The discovery came about via an AI agent. In August, researcher Sagi Tzadik prompted an AI agent to adapt a WordPress exploit for Drupal; the agent failed but instead uncovered a PHP flaw that had gone unnoticed for more than a decade. Separately, researchers working with OpenAI found a related bug, and a group of about 15 people collaborated on a fix.

Word of the flaws spread two days before the planned patch date, leading PHP's maintainers to release the fix a day early. Hours later, a video of an exploit was mistakenly posted, and tens of thousands of exploitation attempts took place within 45 minutes of the public announcement, eventually escalating to millions. The episode is a reminder that patching the language runtime matters as much as patching the application on top of it.