Half the Internet Goes Dark Due to One Elephant
Two vulnerabilities in PHP, a leaked attack tool, and a world pulling the plug as a precaution. And AI is on both sides of the table.
Figure 01.0 — Half the Internet Goes Dark Due to One Elephant
What is Happening?
Date: Wednesday, 21 October 2026
PHP is the programming language powering a large part of the web. WordPress, Drupal, Joomla, and virtually all Magento webshops run on it. You never see it, but it is the engine.
In that engine, there are two vulnerabilities that allow an outsider to run their own code on a server without logging in. The front door is open, the key is on the mat. Both vulnerabilities score 9.2 on a scale of 10. The information leaked a day early, so PHP brought the repair forward: today at 16:00 Dutch time.
The European cyber team CERT-EU advised organisations that cannot update immediately to take their sites offline. Thus, globally, everything from governments and media companies to webshops went dark. Older versions, PHP 5 and 7, will no longer receive repairs.
Where Does AI Come Into Play?
Full Disclosure: no one has confirmed that AI discovered these vulnerabilities. But the connections are striking.
The leaked attack tool, PHP2Shell, names Calif as the creator. On Calif's own site, it states that half of their work involves AI security, and they offer AI-driven vulnerability research.
What Calif previously demonstrated: an attack chain on WordPress that would normally take an experienced hacker weeks, they built with Codex in less than an hour. The WordPress attack that chain was based on was found with GPT 5.6-Sol.
AI is also working on the defensive side. Earlier this year, Claude Mythos found 19 vulnerabilities in Symfony and Twig, two major PHP components. All 19 were genuine.
And Today Itself: the technical explanation circulating is likely derived from a language model through GitHub changes, according to security researcher Kevin Beaumont. And yet, it is partly on the right track.
The Real Story
AI makes finding vulnerabilities faster. For those who repair, and for those who attack. As soon as the repair is released, you can see what has changed, and thus where to look. Sansec expects mass attacks within fifteen minutes of the release. Previously, as an administrator, you had days. Now you have minutes.
Do you have a website? Ask your hosting provider today if PHP will be updated.
