Kodi Fletcher

AI attacks on the web are real right now. Here is what I am doing about it.

Published Last updated 16 min read

I've been following the security news this week, and it is serious. Below I explain what is going on in plain words, then list six steps that help.

I don't want to scare you. Much of this is out of your control, but a few simple steps will make you safer, and even one of them helps.

The six steps are first. The technical detail for site owners comes after them.

What is happening

Right now, AI agents are likely probing the websites you use for weak spots, and when they find one they try to break in. Many agents do this at once, and they do not stop.

This week a serious flaw became public in PHP, the software that runs a large part of the web. Attackers started testing it soon after the news came out and have now tried it millions of times. A fix is available, but each website owner has to install it, and many have not yet.

That is one example of several this week. In Matt Shumer's post on X, he says that in some of the others, attackers used AI tools against organizations and banks. He also says government agencies warned that attackers are using AI to study the systems that run important infrastructure.

Why this is different

Software always has hidden bugs. Finding and using them used to take rare skill, and the small number of people who had it gave us some protection.

AI changes this. It helps attackers find bugs faster and use them with less skill and less money. As attacks get cheaper, there are more of them.

Defenders use AI too, which is good news. But each fix still has to be written, tested, and installed on many systems, and that takes time. For now, attackers are moving faster than the patches.

What I recommend you do today

  1. Update your devices. Update your phone, computer, tablet, and web browser. Use the update option in your device settings. Do not install an "update" from a pop-up or from a link in a message.
  2. Use a different password for each account. A password manager makes this easy. Many phones and browsers include one.
  3. Turn on two-factor authentication (2FA). Do this first for your email and your bank accounts.
  4. Stay away from unfamiliar sites for now. Do not type a password or card number into a site that you do not know. Use the large, well-known sites that you already trust.
  5. Treat unexpected contact from "your bank" as a possible scam. Do not click their links. Do not call back the number they give you. Hang up, and call the number on the back of your card.
  6. Keep some basic emergency supplies. Services you use every day can go down for a while, so keep enough cash, food, and water for a few days.

If you're not a tech person, start here

What this means for you

If you have a website, it may run on PHP. If it does and nobody has updated it this week, attackers may be able to take it over. If you don't have a website, read the next part.

Don't have a website? Here's what still matters to you.

You don't need to do anything about PHP. The sites and apps you use, like your bank, your stores, and your email, run their own servers. It is their job to install the PHP fix. You can't do it for them.

Your part is to keep your own accounts and devices safe:

  • Keep your phone, computer, and web browser on automatic updates.
  • Use a password manager and turn on 2FA. Start with your email and your bank.
  • Watch for scams written with AI. They can look and sound real. Be careful with urgent emails, texts, and calls that say "log in now." Do not click the link. Go to the site or app yourself instead.
  • Be careful with a call that sounds like someone you love and asks for money. Scammers can use AI to copy a voice. Hang up and call the person back on a number you know. The FTC explains this scam.
  • Check if your email address was in a data breach at haveibeenpwned.com. If it was, change the password for that account and for any account that uses the same password.
  • Know where to report a scam. In the US, report scams to the FTC at reportfraud.ftc.gov. Report online crime to the FBI at ic3.gov.

Do you run a small business with a website that someone else hosts or built for you? Then this affects you too. Send your host or web person the email below.

A 5-minute checklist

  • Ask your web host or web person two questions. Does my site run PHP? Is it on a fixed version (8.5.12, 8.4.27, 8.3.36, or 8.2.35)? You can use the email below.
  • Turn on automatic updates on your phone and computer. If your web host or website tool offers automatic updates, turn those on too.
  • Use 2FA and a password manager. Start with your email and your bank.
  • Be careful with urgent emails that ask you to log in. Do not click the link. Go to the site yourself instead.

Ask an AI assistant to explain it

You can paste a prompt into ChatGPT, Claude, or Gemini. Use the first prompt if you have a website. Use the second prompt if you don't. Fill in the parts in square brackets first. AI tools can make mistakes, so check the answers with your web host or another trusted source.

Never paste passwords or private keys into an AI tool.

Prompt if you have a website

I am not a technical person. Please help me understand two PHP security flaws that were announced on October 21, 2026: CVE-2026-109618 and CVE-2026-109619. The fixed PHP versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

1. Explain in plain language what these flaws are and why they matter for a small website.
2. Help me check whether my website or hosting is likely affected. Tell me what information I should gather and where I can find it. My website is [your website address]. My web host is [your web host, or "I don't know"]. It was built with [how it was built, or "I don't know"].
3. Write a short, polite message I can send to my web host or web person. It should ask whether my site is affected and when it will be updated.

Do not ask me for passwords, private keys, or login details.

Prompt if you don't have a website

I am not a technical person, and I don't have a website. I read that attackers are using AI to find weak spots in websites and to write more convincing scams. Please help me check that my accounts and devices are safe.

1. Give me a short, simple checklist to make sure my phone, computer, and web browser update automatically. My phone is [your phone, for example iPhone or Android]. My computer is [your computer, for example Windows or Mac, or "I don't have one"]. My web browser is [your browser, for example Chrome, Safari, or Edge].
2. Help me choose a password manager and turn on two-factor authentication (2FA). Start with my email and my bank.
3. Teach me how to spot scam emails, texts, and calls, including calls that use an AI copy of a family member's voice. Give me simple rules I can follow.
4. Tell me what to do if I think I was scammed, or if my email address shows up on haveibeenpwned.com.

Do not ask me for passwords, private keys, or login details.

Email to send your web host or web person

Email template

Subject: Is my website affected by the PHP flaws CVE-2026-109618 and CVE-2026-109619?

Hi [name],

On October 21, 2026, the PHP project released fixes for two critical security flaws, CVE-2026-109618 and CVE-2026-109619. Government cyber agencies in the US and the UK have asked organizations to update right away.

Can you please tell me:
1. Does my website, [your website address], run on PHP?
2. If it does, which PHP version is it on now?
3. Is it updated to a fixed version (8.5.12, 8.4.27, 8.3.36, or 8.2.35) or to a patched package from your vendor? If not, when will it be?

Thank you,
[your name]

Good places to learn more

The PHP flaw in detail

This part is for people who run a website, or who want the full story. Every fact here links to its source at the end of the page.

What it is

On October 21, 2026, the PHP project released fixes for two critical flaws in PHP itself. Together, the researchers who found them call them "PHP2Shell". Both let an attacker run their own code on a web server without logging in. The PHP project rates each one 9.2 out of 10 (CVSS 4.0, Critical).

The two flaws
CVE and PHP advisoryWhat goes wrongScore
CVE-2026-109618
GHSA-w8hw-w9fx-j79w		Remote code execution through out-of-memory corruption9.2 Critical
CVE-2026-109619
GHSA-6wmf-4rv5-p3rp		Remote code execution through stale global state9.2 Critical

The PHP project says the risk applies to "all PHP installations serving web requests", including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. It considers the risk highest for mod_php. Popular website software such as WordPress, Drupal, and Joomla runs on PHP, and Wiz Research showed the attack working against all three.

How it works, in plain words

A web server that runs PHP keeps a few worker processes alive and reuses them for request after request. Both flaws break the cleanup between those requests.

  • CVE-2026-109618. When a request runs out of memory, PHP stops it suddenly. Some internal data can be left half set up at that moment, and the cleanup step then treats that data as if it were valid.
  • CVE-2026-109619. Some internal settings point into memory that belongs to one request. In some cases they are not reset when that request ends. A later request in the same worker can then use memory that was already freed.

In both cases a carefully built request can turn that confusion into control of the server. I will not go further than that here. The point for site owners is simple: the attack needs no password and no special access, only a normal web request.

Wiz Research found the flaws with help from AI tools. Wiz also credits the PHP team, Calif, and OpenAI. Wiz says the bugs go back as far as PHP 5.4.

Affected and fixed versions

PHP versions and fixes
PHP branchFixed inNotes
8.58.5.12Supported
8.48.4.27Supported
8.38.3.36Supported
8.28.2.35End of life on December 31, 2026
8.1 and olderNo release from the PHP projectMinimal source fixes exist for 7.4, 8.0, and 8.1. Ask your operating system or support vendor for a patched package.

The test release PHP 8.6.0 RC4 also includes the fixes. The PHP project says: "There are no complete mitigations, updating is the only safe choice."

Is it being used by attackers?

Attempts are clearly happening. Whether they succeed is less clear, and the sources say different things. Here is what each one said, in its own words where possible:

  • Cloudflare. Its CEO, Matthew Prince, posted that Cloudflare saw "thousands of attempts" in the 10 hours before the public announcement, then "tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now." His post is below.
  • Amazon. Amazon's threat intelligence team saw an attempt in its honeypot sensors on October 17, before the public release, and says PHP2Shell "is now seeing broad exploitation attempts in the wild."
  • CERT-EU. It says early proof-of-concept code has begun to circulate, which "raises the likelihood that attackers are already exploiting the vulnerabilities."
  • CSA Singapore. Its alert, updated October 23, says there "have been reports of widespread exploitation attempts".
  • CISA. On October 21 it said it had not observed exploitation as of the time of publication.
  • Canadian Centre for Cyber Security. It says proof-of-concept code is available, with no active exploitation identified at the time of its alert.
  • CISA's Known Exploited Vulnerabilities catalog. As of the October 23 catalog, neither CVE is listed.
Matthew Prince 🌥@eastdakota

Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.

Text from the X API, rendered on Oct 23, 2026. Links shortened by X are shown expanded.

Matthew Prince, CEO of Cloudflare, on X, 6:25 PM PT, Oct 21, 2026. View the post on X.

Timeline

Times are Pacific Time (PT).

  1. August 19. Wiz Research discovers the issue. It shows remote code execution on Drupal on August 20 and on WordPress on August 21.
  2. August 24. Wiz reports the flaws to the PHP project.
  3. September 21. The PHP project acknowledges the reports.
  4. October 17. Amazon sees an attempt in its honeypot sensors, before any public release.
  5. October 20. The PHP project announces an upcoming critical security release.
  6. October 21, 3:07 AM. NCSC UK tells organisations to prepare to update.
  7. October 21, 7:00 AM. PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 are released with the fixes.
  8. October 21, through the day. NSA, FBI, CISA, CERT-EU, the Canadian Cyber Centre, and others publish alerts.
  9. October 21, 6:25 PM. Cloudflare's CEO reports "millions" of attempts.
  10. October 22. Matt Shumer posts about it on X. I publish this article.
  11. October 22, 10:58 PM. The Australian Signals Directorate tells organisations to act now.
  12. October 23. The PHP project posts an informational note about a third, separate issue, CVE-2026-115560. It only affects an unusual session setup, and the PHP project suggests setting session.upload_progress.enabled=0 until the next regular release. Full details come with that release. CSA Singapore updates its alert. At 11:01 AM the FBI repeats its warning.

If you run a website

This is a summary of the advice from the PHP project, CISA, the FBI, NSA, and NCSC UK. If someone else runs your site, send them this list.

  1. Find out if your site uses PHP. If you use WordPress, Drupal, Joomla, or many shared hosting plans, it probably does. Ask your hosting provider or developer which PHP version runs your site.
  2. Update now. Move to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or to your vendor's patched package. Start with sites that face the internet. Make sure the server is running the new version after the update.
  3. If you are on PHP 8.1 or older, plan a move. The PHP project does not release fixes for these versions. Ask your vendor for a patched package, and plan an upgrade to a supported version.
  4. If you cannot update today, consider taking the site offline. NSA, the FBI, NCSC UK, and CISA all give this advice. CISA adds that a web application firewall may help.
  5. Know that stopgaps are not a fix. The PHP project lists settings that reduce exposure, such as a memory_limit of -1 set by the server administrator, a small post_max_size, and session.upload_progress.enabled=0. It says these "do not make an installation safe".
  6. Look for signs of an attack. CISA and the FBI say to watch for PHP processes that start command shells or download files. Wiz lists unusual multipart form requests followed by memory-limit errors or repeated server errors, very large or malformed session cookies, and PHP workers that restart for no clear reason. NCSC UK also advises checking for backdoors.
  7. If you find a compromise, report it. Isolate the system and keep your web server and PHP logs. In the US, report to your local FBI field office or ic3.gov. In other countries, report to your national cyber agency.

What government agencies said

Below are the posts these agencies made on X. I rebuilt each one on this page from the post text, which I checked through the X API, so this page does not load anything from X. Use the link under each post to see the original.

NCSC UK@NCSC

The NCSC is encouraging UK organisations to prepare for immediate updating of systems using PHP. Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated. For more⬇️ ncsc.gov.uk/news/critical-security-issue-affecting-php

Text from the X API, rendered on Oct 23, 2026. Links shortened by X are shown expanded.

NCSC UK, the UK National Cyber Security Centre (@NCSC) on X, 3:07 AM PT, Oct 21, 2026. View the post on X. NCSC alert.
NSA Cyber@NSACyber

Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.

Show full postShow less

Text from the X API, rendered on Oct 23, 2026. Links shortened by X are shown expanded.

NSA Cyber, the US National Security Agency (@NSACyber) on X, 6:45 AM PT, Oct 21, 2026. View the post on X. NSA press release.
FBI Cyber Division@FBICyberDiv

Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks. The FBI urges organizations to take the following steps now: ➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated. ➡️ Immediately update affected PHP installations following the guidance on php.net. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP. ➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation. ➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or ic3.gov. Those reports help us identify the actors involved and warn other organizations before they become victims. For the latest information, follow PHP’s announcement on php.net, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.

Show full postShow less

Text from the X API, rendered on Oct 23, 2026. Links shortened by X are shown expanded. The original post includes an image.

FBI Cyber Division (@FBICyberDiv) on X, 7:59 AM PT, Oct 21, 2026. View the post on X. Report a compromise at ic3.gov.
CISA Cyber@CISACyber

🚨 Organizations should immediately patch critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. These vulnerabilities enable unauthenticated #RCE and affect PHP installations serving web requests. Learn more: 🔗 go.dhs.gov/5Hi

Text from the X API, rendered on Oct 23, 2026. Links shortened by X are shown expanded. The original post includes a video.

CISA Cyber, the US Cybersecurity and Infrastructure Security Agency (@CISACyber) on X, 9:40 AM PT, Oct 21, 2026. View the post on X. CISA alert.
Canadian Centre for Cyber Security@cybercentre_ca

#CyberAlert | AL26-026 Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619 The Cyber Centre is aware of critical vulnerabilities affecting PHP. cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619

Text from the X API, rendered on Oct 23, 2026. Links shortened by X are shown expanded. The original post includes an image.

Canadian Centre for Cyber Security (@cybercentre_ca) on X, 12:15 PM PT, Oct 21, 2026. View the post on X. Cyber Centre alert AL26-026.
Australian Signals Directorate@ASDGovAu

❗ ACT NOW ❗ Install critical security updates for PHP. Organisations should identify use of PHP, apply the latest patches and monitor for suspicious activity. Hosting providers can contact us on 1300 CYBER1 (1300 292 371). Review the guidance 👉 cyber.gov.au/alert/critical-vulnerabilities-in-php

Text from the X API, rendered on Oct 23, 2026. Links shortened by X are shown expanded. The original post includes an image.

Australian Signals Directorate (@ASDGovAu) on X, 10:58 PM PT, Oct 22, 2026. View the post on X. ASD alert on cyber.gov.au.

Follow-up posts: NSA Cyber shared its detailed guidance at 5:43 PM PT on October 21. The FBI repeated its warning at 11:01 AM PT on October 23. CSA Singapore posted its updated alert at 3:45 AM PT on October 23.

CERT-EU published Security Advisory 2026-018. I could not find a post about it on X from CERT-EU.

Sources

The PHP project

CVE records

Government and CERT advisories

Research and reports