Commenting on the PHP2Shell vulnerability crisis, Microsoft CEO Satya Nadella said: I haven’t seen anything like this in a very long time. It has been a long day and a long night for everyone in IT and cybersecurity.
Satya Nadella’s remarks on global security mobilization
Millions of cyberattacks and the role of the GPT-5.6 Sol model in uncovering the two vulnerabilities
Disruption of electronic services from Tokyo to Helsinki and international government mobilization
IT team burnout and misinformation risks
Frequently asked questions
Satya Nadella’s remarks on global security mobilization
Satya Nadella, CEO of Microsoft, said on Thursday that the global state of mobilization to address security vulnerabilities in the PHP programming language has no parallel in recent history. Speaking at a company event in Cologne, Germany, and as reported by Reuters, Nadella stated: “I haven’t seen anything like this in a very long time,” adding according to The Independent: “It has been a long day and a long night, I know that, for everyone in information technology and cybersecurity.”
Nadella’s comments came after PHP developers released patch updates on Wednesday, October 21, 2026, to address two security vulnerabilities that had lurked in the software for years before artificial intelligence tools helped uncover them. Since then, governments and companies around the world have continued intensive work to apply security updates at a time when hacking attempts have surged into the millions, according to Reuters reports.
Millions of cyberattacks and the role of the GPT-5.6 Sol model in uncovering the two vulnerabilities
According to Fortune, the two vulnerabilities—designated CVE-2026-109618 and CVE-2026-109619 and known as PHP2Shell—allow attackers to execute remote code on unpatched servers, with an estimated 70% of the world’s websites using PHP. Matthew Prince, CEO of Cloudflare, revealed that exploitation attempts jumped from thousands of attempts before the official announcement to “tens of thousands within 45 minutes of the announcement, hundreds of thousands within two hours, and millions now,” according to Reuters.
Meanwhile, Amazon announced it detected an exploitation attempt against one of its honeypot systems on October 17, 2026, a full four days before the public disclosure of the vulnerabilities, confirming that the PHP2Shell tool “is now being actively exploited across cyberspace,” according to ABC News.
Cybersecurity firm Calif discovered the two vulnerabilities in August using OpenAI’s GPT-5.6 Sol model as part of a PHP code security audit funded by OpenAI, according to Agence France-Presse. Wiz Research also independently discovered the vulnerabilities, while PHP versions 8.1 and earlier will not receive an official patch, based on Investing.com.
Disruption of electronic services from Tokyo to Helsinki and international government mobilization
The crisis led to the suspension of digital services in several countries. In Japan, Nomura Holdings, Mitsubishi UFJ Financial Group, All Nippon Airways, and East Japan Railway temporarily suspended some of their online services, while Asahi Group Holdings and Tokio Marine Holdings also shut down some of their websites, according to Reuters.
In France, telecommunications company Orange restricted access to certain PHP-based websites. Finnish government IT provider Valturi warned that restoring services “could take days or even weeks,” while South Korea raised its private sector cyber alert level, and the US National Security Agency urged organizations to remain on “heightened alert” over the coming weeks, according to NPR.
IT team burnout and misinformation risks
IT professionals told the BBC that the past 48 hours have been extremely exhausting. British systems administrator Adam Mudd said: “It’s been relentless.” Security experts explained that false reports regarding active exploitation software exacerbated panic, despite a lack of evidence so far pointing to widespread breaches.
Mark Maunder, founder of cybersecurity firm Wordfence, warned in remarks cited by the BBC of the need to improve security communication mechanisms, stating: “We need to refine our messaging” before AI tools uncover similar deep vulnerabilities in the future.
Frequently asked questions
Question: What are the two vulnerabilities that caused the global PHP2Shell crisis?
Answer: They are CVE-2026-109618 and CVE-2026-109619, which allow remote code execution on unpatched servers.
Question: How did artificial intelligence contribute to discovering the PHP vulnerabilities?
Answer: Security firm Calif discovered the two vulnerabilities in August using the GPT-5.6 Sol model during a security audit funded by OpenAI, and Wiz Research also discovered them independently.
Question: What is the scale of affected sites and recorded hacking attempts?
Answer: About 70% of websites use PHP, and Cloudflare announced that exploitation attempts jumped from thousands to millions within hours of the announcement.
Question: What are the most prominent organizations and countries that suspended their services due to these vulnerabilities?
Answer: Major Japanese companies such as Nomura, Mitsubishi UFJ, and Asahi suspended some services, France’s Orange restricted certain websites, while South Korea, Finland, and the United States raised their alert levels.
