PHP’s maintainers released emergency fixes on October 21, 2026 for a pair of critical, years-old unauthenticated remote code execution flaws nicknamed ‘PHP2Shell’, after cybersecurity firms Calif and Wiz independently reported finding the bugs using AI models, including Wiz’s Atlas tool, Google’s Gemini 4 Argon, and OpenAI’s GPT-5.6 Sol. Government agencies across Europe and other organizations, including the Dutch national cybersecurity agency, took websites offline as a precaution once the flaws became public, and Wikipedia’s operator and the Internet Archive briefly took systems down to patch. Censys estimated roughly 1.5 million of 2.6 million internet-facing PHP hosts had no fix available yet, and researchers warned of a wave of exploitation given that PHP powers an estimated 70-75% of the web.