Black Wednesday and PHP2Shell: What Website Owners Should Do Now

October 21 stacked five emergencies into one day

Some are calling October 21 Black Wednesday, and the Guardian reports the wider stretch is being called "Black October." The label fits. TechCrunch's same-day rundown noted that government websites around the world went offline while teams patched PHP, and that the PHP fix was only one of several on the same afternoon.

None of these incidents caused the others. What they share is timing, and a common thread that security leaders kept returning to all week: AI is making it faster to find serious bugs, and faster to weaponize them once they are public.

PHP2Shell is a server problem, not a plugin problem

The PHP project's advisory describes two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that "can allow unauthenticated remote code execution." According to The PHP Foundation, both stem from how PHP cleans up after a fatal error, such as hitting its memory limit at the wrong moment. Leftover internal state can then be reused by a later request, which is the opening an attacker needs. Both carry a CVSS score of 9.2.

The NSA's advisory made the point most site owners need to hear:

"These vulnerabilities are flaws in PHP itself, not in the hosted application or its configuration."

That is why WordPress updates do not help. Researchers at Wiz demonstrated pre-authentication code execution against the latest official WordPress, Drupal and Joomla container images, and said exploitation does not depend on the application at all. A basic PHP page on an affected version is exposed.

The reach is wide. W3Techs reports PHP is used by 69.2% of websites whose server-side language it can identify. Wiz rounded that to "70% of the Internet," which is the figure that went viral, but the W3Techs wording is the precise one. Exposure is not hypothetical either: The Record reported that Censys counted more than 41 million internet-facing PHP services on affected versions as of October 22, against about 1 million on a fixed release.

AI found the bugs, and attackers moved within hours

The Guardian noted that this is the first time researchers used AI to find a flaw this fundamental. OpenAI said security firm Calif found one of the bugs using GPT-5.6 Sol through its Patch the Planet initiative, and that Wiz independently found both. Wiz credited its own AI researcher plus Gemini 4 Argon and GPT-5.6 Sol, and said a single researcher finished in a week what would once have taken a world-class team months. Wiz, Calif and OpenAI all sell security products or services, so each has a reason to emphasize how capable their tools were.

The defenders did not get much of a head start. The PHP Foundation's timeline shows the CVE numbers leaked on October 20, Calif mistakenly published a video of its proof of concept that evening, and one distributor shipped patched images more than six hours before the embargo lifted. Amazon Threat Intelligence recorded an exploitation attempt against its honeypots on October 17, four days before disclosure.

"Defenders should not assume the public disclosure date is the earliest date of exploitation."

Cloudflare CEO Matthew Prince described the curve on X, as quoted by the Guardian: thousands of people trying to exploit the flaws in the 10 hours before the announcement, "tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now." Anthropic's deputy CISO, Jason Clinton, warned on X of a coming "vulnerability tsunami."

Why it matters for marketing teams. Your site's patch window used to be measured in weeks. Amazon's own advice is now to measure response times for critical internet-facing flaws in hours, because a 7 or 30 day patch policy no longer matches how fast exploits appear.

The panic outran the evidence, for now

A lot of the coverage, and much of what circulated on social video, suggested that any WordPress site was probably compromised already. The reporting does not support that. The Record reported on October 23 that experts had confirmed no successful wide-scale exploitation. Google's John Hultquist said his team had not validated in-the-wild exploitation, though "exploitation may have already begun in a limited fashion."

The reason is practical. VulnCheck's Spencer McIntyre told The Record that many public proof-of-concept exploits were "garbage and nonfunctional," and incident responders said a standard memory protection, address space layout randomization, was stalling attackers. Sophos reported, then retracted, a claim of successful exploitation.

None of that is a reason to wait. Trail of Bits reported working exploits by October 23, according to TechCrunch, and Cobalt's CISO told The Record defenders may have "days, not weeks" once a reliable technique reaches botnet toolkits. Scanners hunting for vulnerable servers were already running.

Your AI keys became the target

The other story of the week had nothing to do with PHP. Attackers went after the API keys companies use to pay for OpenAI, Anthropic and Google models, because a stolen key converts straight into usable compute.

• OpenCode said a "large-scale distillation attack" hit 1.4% of its Console users, with some reporting charges above $1,000. Anthropic and Google blocked exposed keys, and OpenAI issued refunds.
• Railway estimated that up to 1.85% of workspaces, about 100,000, had environment variables potentially exposed, and said the attacker sought AI provider keys "to perform distillation attacks."
• LiteLLM's malicious 1.107.0 release was live on PyPI for under two hours on October 21 and stole credentials from any host that installed it.

The motive lines up with a September warning from the NSA, FBI and CISA, reported by ExecutiveGov, that China-based AI companies run "industrial-scale knowledge distillation campaigns" against US models, helped by a gray market of API proxies the agencies call "transfer stations." OpenCode and Railway have not published proof of who was behind their breaches, so treat the link as context, not attribution.

OpenCode also hit a defender's problem: commercial models refused to help analyze the malicious code once it tripped safety filters. Both labs now run vetted programs for this, OpenAI's Daybreak and Anthropic's Cyber Verification Program, and OpenCode got Daybreak Blue access mid-incident. If your company does its own security work, apply before you need it.

Going offline does not have to cost you rankings

Both agencies told organizations to take systems offline if they could not patch immediately. The FBI said to "take the system offline until it can be fully mitigated," and the NSA used the same language. For a marketing site, how you go offline decides whether search engines notice.

Google's John Mueller gave the answer on Bluesky the day of the patch, as Search Engine Roundtable reported:

"use HTTP 503 instead of letting responses time out / 404 / 500."

A 503 tells crawlers the outage is temporary and to come back later. A 404 or a string of timeouts invites them to start dropping pages. Mueller added that the 503 can be served from outside PHP, through DNS or a CDN, which matters when PHP itself is the thing you are switching off. Google's guide to pausing a website covers longer closures, and our weekly roundup for October 19 to 23 has more on how Google handled the week.

The bigger search risk is a successful hack. Injected spam pages and malware trigger Search Console's Security issues report, can put a warning label on your listings, and only clear after you fix the whole site and request a review that can take days or weeks. A few hours of 503 is cheap by comparison. Check the report in Search Console this week, even if your host says you are patched.

The rest of the week's patch list

PHP took the headlines, but the other October 21 fixes reach plenty of marketing stacks too.

The Node.js releases fix ten CVEs, including a high-severity Brotli decoder flaw that can lead to code execution in any app that decompresses untrusted data. That one was reported by OpenAI's Codex Security. GitLab's flaw scores the maximum CVSS 10.0 and reaches self-managed versions back to 7.0, with no workaround. Google blocked eight compromised eMudhra certificate authorities in Chrome and is removing their root, so any site with a certificate from that chain needs a new one.

WordPress owners have a second item. Search Engine Journal reported that attackers stole UpdraftCentral connection keys from the vendor behind UpdraftPlus, a backup plugin on over 3 million sites, and used them to install backdoor admin accounts. The update revokes old keys but does not remove plugins or accounts the attackers already added.

Where to start

Black Wednesday will not be the last week like this. The same AI that found PHP2Shell is pointed at every other old library on the web, which means the patch cadence for a marketing website now looks a lot more like the one for a bank. The sites that come through intact will be the ones where someone owns that job before the next advisory lands.