The NSA told the software behind 7 in 10 websites to patch or go offline. An AI found the bugs. Patching is now the bottleneck.
Originally published on LinkedIn.
Yesterday morning the NSA's cybersecurity account posted something I've never seen a government agency say about mainstream web software. Every organization running PHP should get ready for an emergency fix for two critical flaws. And if you can't update right away, the NSA said "it is recommend that organizations take the system offline until it can be fully mitigated."
Typo and all, that post passed 11 million views.
Take your site offline. That's the advice. For a lot of businesses, a website is the storefront, the booking page, and the checkout. I spent years in sales, and I can tell you nobody in a revenue meeting wants to hear "we turned the website off on purpose."
So I read everything I could find about what happened. Here's the plain version, the numbers, and the part I think most people are missing.
What PHP is, and why this one is big
PHP is the programming language running behind most of the web. WordPress runs on it. So do a huge number of online stores, school portals, city websites, and small business sites that someone built ten years ago and nobody has touched since.
W3Techs says PHP runs 69.3% of the websites where it can tell what language the server uses. Censys counted nearly 55 million web properties running PHP.
The two flaws have been nicknamed "php2shell." The UK's National Cyber Security Centre explains them this way: an attacker can push PHP into an out-of-memory state that corrupts memory, and under the right conditions that becomes remote code execution with no login needed. Translation: a stranger on the internet could run their own code on your server. The NCSC says organizations on any version of PHP are affected.
What happened on October 21
A few things happened fast.
- According to the PHP Foundation, as reported by NBC News, the security company Chainguard shared details of the patch about six hours before it shipped, breaking an embargo. PHP says that gave attackers a head start on reverse engineering the fix. Chainguard hadn't commented when NBC published.
- PHP released the fixes around 10 a.m. Eastern.
- CISA said it had not seen exploitation at the time of its advisory. Patchstack said it had reports of active exploitation, and Cloudflare's CTO posted that it was seeing early attacks. Both can be true at different hours of the same day.
- Government services in the Netherlands, Finland, France, and Australia went offline temporarily to patch, according to The National. NBC reported Japanese sites, Pinboard, parts of Wikipedia, and 4chan offline too.
Governments chose downtime over risk. That tells you how seriously they took it.
An AI found it
Here's the detail that made me stop scrolling. OpenAI says it helped discover the vulnerability. NBC reports it came through OpenAI's program that gives cybersecurity companies access to models that are good at finding software flaws, and The National says one of OpenAI's models found it.
That's the good news. A frontier AI model helped find a critical bug in the software under most of the web, and it was reported to the people who maintain it so they could fix it.
But think about what it means for the next one. If AI can find bugs like this faster, the hard part is no longer finding them. The hard part is everyone else patching in time.
The real bottleneck: old software nobody owns
This is the chart I'd want every business owner to see.
Per W3Techs, 34.7% of PHP websites run PHP 7, 5, or 4. None of those versions is on PHP's list of supported versions anymore. The same goes for PHP 8.0 and 8.1, so the real number is higher than a third. PHP's site lists 8.2 through 8.5 as the only supported branches today, and 8.2 drops off at the end of this year.
The NCSC's advice reflects that. It tells anyone on an older version to move to a fully supported one, and to check for backdoors before upgrading, because an attacker who got in first may still be there after you patch.
That's not a technology problem. It's an ownership problem. Somebody built the site, the agency moved on, the plugin vendor stopped updating, and now nobody can say which version is running or who is allowed to change it.
What I'd do this week
I'm not a security engineer. I run AI agents for my own back office, and I've learned the hard way that every tool you depend on needs a named owner. So this is the checklist I'd hand any small business or sales team:
- Find out if you run PHP. If you use WordPress, WooCommerce, or a site an agency built, the answer is probably yes. Ask your host or developer today, in writing.
- Ask what version. If the answer is 7.x or older, you're on software with no support, and the conversation is about upgrading, not just patching.
- Update to the latest supported release. The PHP project posted the fixes and temporary mitigations on php.net.
- If you can't update yet, use the mitigations, or take the site down. That's the NSA's advice, and the NCSC's, and several governments followed it.
- Check for compromise. Patching locks the door. It doesn't remove someone already inside.
- Ask your vendors. Many products bundle PHP inside them. The Dutch NCSC keeps a public list of affected products on GitHub.
The bigger lesson
AI just showed it can find serious holes in the plumbing of the internet. That's a gift if defenders move at the same speed. The companies that come out of this fine won't be the ones with the best AI. They'll be the ones that knew what they were running, who owned it, and could update it the same day.
Is the website your business depends on owned by a person, or by a contractor who left three years ago?
Sources
- NSA Cyber on X, October 21, 2026
- NBC News: Critical vulnerabilities in PHP spark rush to update systems
- UK NCSC: Critical security issue affecting PHP
- CISA alert, October 21, 2026
- The National: Websites taken down as OpenAI spots issue with backbone of internet
- W3Techs: PHP usage statistics
- PHP: Supported versions
- NCSC-NL php2shell product list on GitHub
More of what I write about AI, markets and running a business is at loganwinn.com/blog.
Cover photo: NSA headquarters, Fort Meade, Maryland. Trevor Paglen, 2013, CC0, via Wikimedia Commons.
