The Verdict First:

Yes, websites really did go dark during the PHP crisis, but mostly because their owners switched them off on purpose, not because hackers knocked them down. Yes, AI agents really have compressed attacks from weeks into hours, but they still need the same old weaknesses (unpatched systems, stolen credentials, exposed services) to get in. And no, it is not true that "nothing is safe anymore." What is true is that unsafe development, especially AI generated code shipped without review, is now being punished faster than ever.

Part 1: Did PHP Really Take Down the Internet?

If you heard that "all government, university and big company websites went down because of PHP," you heard a story that is half true; and the half that is wrong matters.

What actually happened

On 21 October 2026 , PHP released emergency fixes for two critical vulnerabilities , CVE-2026-109618 and CVE-2026-109619 , collectively called PHP2Shell .…