Wednesday, 21 October 2026. For most people it was an ordinary working day. Then, one after another, government websites in France, Denmark, Finland and the Netherlands went dark. Even the site of the Dutch cyber security agency disappeared behind a maintenance page. Across the Atlantic, Canadian federal sites followed. Nobody had broken in. Their own operators had switched them off, racing to patch two critical flaws in PHP, the language that runs about 70% of the web. The flaws had been hiding for more than a decade, until frontier AI models helped researchers find them. If you write software for a living, this is a week worth slowing down for.

The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and security firms call them PHP2Shell. Both are rated 9.2 on the CVSS v4.0 scale, which counts as critical ( Quartz ). They are memory safety bugs in how PHP cleans up after a fatal error, especially an out of memory error.…