Ondřej Surý, a Linux developer, became a critical figure in addressing a severe PHP vulnerability that disrupted global websites, as AI-driven discoveries accelerated cybersecurity challenges.
Ondřej Surý, a Linux developer, became a pivotal figure in addressing a critical PHP vulnerability that triggered a global cybersecurity scramble in October 2026. The flaw, discovered through AI audits, affected 70% of websites, prompting major disruptions and urgent patching efforts. Surý, who has maintained PHP packages for over two decades, worked tirelessly to distribute fixes, receiving $10,000 in donations during the crisis. I feel responsible for all these people and I can't fail them,
he said, highlighting the pressure of securing the internet’s infrastructure.
There's a severe bug in PHP that is apparently being exploited already. To protect everyone's data, I have taken Pinboard offline until patches are released tomorrow. I'll get the site back up as soon as I can after that happens.
— https://x.com/Pinboard/status/2112794148852183450
Emergency Patches Released for PHP Vulnerabilities
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, allowed unauthenticated remote code execution, exposing servers to exploitation. PHP, used by 70% of websites, powers platforms like WordPress, Yahoo, and Wikipedia. Operators rushed to apply patches, with some sites like Wikimedia and 4chan temporarily shutting down. This week is basically about a year's worth of contributions I got before,
Surý noted, highlighting the overwhelming demand for his work.
On October 21, the PHP project released emergency patches for CVE-2026-109618 and CVE-2026-109619, with versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The release was a day earlier than planned after the CVE identifiers leaked online. Hostinger, a web hosting provider, rolled out the updates across its platform by October 22 at 06:44 UTC, notifying customers via email. Act now: Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 as soon as you can,
Hostinger urged, emphasizing the urgency of the fix.
It's not a Nintendo-specific issue. There's a critical, dangerous PHP vulnerability that is affecting most of the web and web-based services right now. These sites/services are going into emergency maintenance mode until a patch is ready to fix the problem.
— https://x.com/thelandfish7/status/2112879150239256927
Corporate Responses and Ongoing Risks
The PHP project published an advisory on October 23 for a related vulnerability, CVE-2026-115560, which affects fully patched PHP releases. It will be fixed in PHP’s next regular release,
the advisory stated, with Hostinger confirming that all hosting plans except VPS were already protected. VPS customers were instructed to set session.upload_progress.enabled = Off in php.ini and restart PHP workers.
Surý’s Reflections and the Future of Cybersecurity
The PHP Foundation criticized Chainguard for breaking an embargo, with its blog stating, On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix.
Dan Lorenc, CEO of Chainguard, defended the decision, saying, This process and policy is based on trying to coordinate as much as possible until shit hits the fan.
The incident highlighted tensions between transparency and security in vulnerability disclosures.
Security firms like Wiz and Calif.io, along with OpenAI, were critical in identifying the flaws. Wiz, owned by Google, found the vulnerabilities independently with help from AI models like Gemini 4 Argon and GPT-5.6 Sol. The discovery marks a new phase, where AI can find security bugs with internet-scale impact,
OpenAI stated. Meanwhile, the PHP Foundation urged users to apply patches promptly, emphasizing that the process can be more complicated for organizations hosting tools managed by different people.
As of October 22, Censys tracked patching progress for PHP2Shell in real time, showing how many internet-facing PHP services still ran vulnerable versions. The crisis has also prompted calls for better coordination between open-source maintainers and corporate stakeholders. It’s kind of fulfilling because I sense my work has a purpose,
Surý said, but I feel that not enough credit has been given to other people who have been part of this.
In our latest fireside chat, Acting Director Nick Andersen discussed how advanced tech -enabled tools are helping adversaries identify and exploit vulnerabilities faster than ever before. Watch now to see how organizations can strengthen their resilience: https://t.co/pxhHqV8D9m pic.twitter.com/b6lgaU7Ui4
— https://x.com/CISAgov/status/2113686991917166931
More on Ondřej Surý
Serebii Update: Pokémon Sleep is to undergo emergency maintenance from 14:00 UTC today.Currently no end time has been given for the maintenancehttps://t.co/NWlAdn5F0o pic.twitter.com/3l0WpJugXf
— https://x.com/SerebiiNet/status/2112876976281412063
pokemon home is in emergency maintenencepokemon champions is in emergency maintenenceall switch 1 and switch 2 online services are in emergency maintenencenintendo what the fuck is going on
— https://x.com/SleepykyuSH/status/2112873591427797168
We’re temporarily taking GOG offline for maintenance for a couple of hours. GOG GALAXY will also be offline during this time. We apologize for the inconvenience and appreciate your patience!
— https://x.com/GOGcom/status/2112924299212226619
Our discussion forum is the only software we have using PHP. We've taken it down temporarily while waiting for the patches for https://t.co/CjXGfNY2ff due to vulnerability details already being available and proof of concept exploits being developed. Don't want to take the risk.
— https://x.com/GrapheneOS/status/2112821646159380954
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
— https://x.com/eastdakota/status/2113079352682570051
Artificial intelligence has enormous potential to improve our cybersecurity. Recently, researchers using AI uncovered critical security vulnerabilities in PHP, a programming language used by millions of websites worldwide. This discovery will help developers address potential…
— https://x.com/JayObernolte/status/2113807112467857796
🚨 Over 22.6M exposed PHP instances are potentially at risk from PHP2Shell.Cortex Cloud helps you identify vulnerable assets, stop unsafe builds, and protect running workloads.Assess your exposure with our new PHP2Shell Security Advisor agent.https://t.co/cVxRZH613P pic.twitter.com/8L3l22kkJV
— https://x.com/PaloAltoNtwks/status/2113392108241367149
The new PHP vulnerabilities aren’t just an admin headache. Home network storage, smart-home hubs and the sites you sign in to every day can be affected too. Here’s how to protect your accounts and files 🏠 https://t.co/Ozcwrgka6i pic.twitter.com/g99bnlxKv7
— https://x.com/kaspersky/status/2113540909413405047
A big shout-out to Ondřej Surý! 👏The https://t.co/y0LiGxbkeo PHP packages now include backported fixes for CVE-2026-109618 and CVE-2026-109619, even for legacy versions like PHP 5.6 and 7.4.This is the kind of work that deserves recognition.Thank you, Ondřej!…
— https://x.com/antrecu/status/2112954710806208839