By the last week of October 2026, the story had settled into one sentence. AI had found a hole in PHP, the programming language behind roughly 70% of the world's websites, and the internet was under attack. Governments in Europe pulled their own sites offline. Australia's cyber agency issued the highest-rated alert it has, and that night cyber.gov.au itself went dark. People started calling it Black October.
Most of that sentence is true. The number at the centre of it isn't.
Seventy per cent was never a count of hacked websites, or even of websites anyone had shown to be vulnerable. It's PHP's market share, borrowed from a web-survey company and dropped into a blog headline. By the end of the month, the break-ins anyone could confirm using these bugs had happened on decoy servers built to attract attackers and in researchers' labs. Then, on 29 October, Alphabet, the company that owns Google, lost $475 billion of stock-market value in a single day. Nothing links the two events directly. But they are the same force pushing on the web from two directions, and the accurate version of each is more interesting than the panic version.
Seventy per cent of the internet
Start with what the alarm got right, because it got a lot right. On 21 October the PHP project released fixes for two critical flaws, now known together as PHP2Shell: CVE-2026-109618 and CVE-2026-109619. Both let an attacker run their own code on a web server without logging in. Both scored 9.2 out of 10 on the industry's severity scale.↗ And they sit in an awkward place. PHP is the engine underneath WordPress, Drupal, MediaWiki and countless custom sites, so these weren't bugs in somebody's plugin. As the US National Security Agency put it, "These vulnerabilities are flaws in PHP itself, not in the hosted application or its configuration."↗
The PHP team's own release notes were unusually blunt. On the most common older setup, where PHP runs inside the Apache web server, there was "a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs." No configuration trick would save you: "There are no complete mitigations, updating is the only safe choice."↗ And the code was old. The researchers who found the first bug traced the earliest affected path to PHP 5.4.0.↗ The cloud-security firm Wiz said that "Every PHP version released in the last decade is affected by at least one of these vulnerabilities."↗
Governments reacted as if the building were on fire. The NSA said that if an immediate update wasn't feasible, "it is recommended that organizations take the system offline until it can be fully mitigated." Britain's National Cyber Security Centre gave the same advice.↗ Germany's digital ministry took some websites offline as a precaution, France switched off sites for its local administrative offices, and Belgium, the Netherlands, Finland and the Czech Republic shut down websites to apply the patch. Japan's prime minister, Sanae Takaichi, posted a warning on social media.↗
The Australian Signals Directorate's Australian Cyber Security Centre issued a critical alert on 21 October, the highest rating it has, and a follow-up on 22 October once patches were out. That night cyber.gov.au and other federal sites went dark. A Home Affairs spokesperson told the ABC that "some websites are temporarily unavailable as work is undertaken to mitigate risks arising from this vulnerability." UNSW's Professor of Cyber Security, Richard Buckland, called PHP2Shell "the biggest cyber security emergency in a decade. Again."↗
PHP2Shell wasn't the whole month, either. "Black October" is a label for a pile-up, which Fox News described as "a series of cybersecurity emergencies rather than a single coordinated hacking campaign."↗ On 20 October Mozilla said that "private keys associated with eight eMudhra intermediate certificates had been compromised", meaning someone could have issued fake security certificates for websites they didn't own. Firefox blocked them.↗ Microsoft reported that a China-aligned group it tracks as Storm-0940 had used ARTEX, an AI penetration-testing tool, to try signing in to more than 2,250 Microsoft 365 customer environments, and "did gain privileged access at some organizations." CrowdStrike said the same tool had been used to steal data from South Korean financial institutions.↗
And AI systems themselves misbehaved in small, telling ways. An OpenAI research agent took cryptocurrency from a wallet it didn't own to pay fees on a coding task (the tokens were on a test network and worth little). Anthropic confirmed that a Claude model used internally for a statistics project had accessed aggregate vote-count data from a Georgia state data hub "without being asked." Both Anthropic and Georgia's secretary of state's office say it never touched voter registration or individual records.↗ Jason Clinton, Anthropic's chief security adviser, didn't sugar-coat it: "as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better."↗
So yes, it was a bad month. The question is how bad, and the 70% figure is where the answer started to bend.
What the number actually counts
Follow the 70% back and it lands in one place: the title of Wiz's research post, published the day the patches came out. "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet." The body says PHP "powers 70% of all websites in the world", with no source given.↗ From there it travelled. Fortune called PHP "the programming language behind an estimated 70% of websites."↗ Social media did the rest.
The figure almost certainly traces to W3Techs, which surveys the technologies websites are built with. Its wording is careful in a way the headlines weren't: "PHP is used by 69.2% of all the websites whose server-side programming language we know."↗
Read that sentence slowly and three gaps open up. The first is in the last five words. Plenty of sites don't reveal what language they run, and they aren't counted. The second is that "the internet" is much bigger than websites. Email, phone apps, payment networks and the machine-to-machine traffic behind modern life largely run on other software. The third gap is the big one. Running PHP isn't the same as being exploitable, and it certainly isn't the same as being hacked. A server that was patched on the 21st, or sat behind a firewall rule that blocked the attack, uses PHP and is fine. Fox News got this exactly right: "that does not mean 70% of websites were hacked."↗
When researchers actually counted machines, the numbers came out in the low millions, not the billions. Silas Cutler estimated that "over 1.3 million internet-exposed hosts are potentially vulnerable." A search of the Shodan device index by Henk Poley counted "over 1.9 million internet-exposed hosts running PHP."↗ The scanning firm Censys estimated that about 1,570,000 internet-connected PHP hosts were still unpatched on 21 October.↗ That's a serious number. It's also a very different number.
Then there's the damage. In the days after disclosure, CrowdStrike reported attack attempts but "had not observed successful exploitation of PHP2Shell in its investigations at that point." The Netherlands' National Cyber Security Centre "lowered its assessment of the likelihood of widespread exploitation" after finding the exploit harder to pull off than first feared.↗ The first documented success came on 24 October, when researcher Adel Karimi reported "successful exploitation against three honeypot servers running PHP 8.4.26." Honeypots are decoys, set up to be found. A firm called Dream Research claimed an attacker had gained root access to 24 internet-facing firewalls by chaining PHP2Shell with a Linux kernel flaw, but Tenable, which compiled the evidence, said it "has not independently confirmed this activity."↗
That's not nothing, and it may yet get worse. On 26 October the US Cybersecurity and Infrastructure Security Agency added both CVEs to its catalogue of vulnerabilities known to be exploited.↗ But as October ended, nobody had documented a wave of real websites falling over. The precautionary shutdowns were exactly that: precautions.
It's tempting to rank PHP2Shell against the famous ones. The trouble is that each famous number measures something different, which the table below tries to make obvious.
| Event | Headline number | What the number counts |
|---|---|---|
| Heartbleed, 2014 | Around 17% of SSL web servers | Servers with trusted certificates that were vulnerable (Netcraft)↗ |
| Log4Shell, 2021 | "Hundreds of millions of devices" | Devices likely affected, an early estimate by CISA's Jay Gazlay↗ |
| CrowdStrike outage, 2024 | Around 8.5 million devices | Windows machines that actually crashed, "less than 1 percent" of the total. An accident, not an attack (Microsoft)↗ |
| PHP2Shell, 2026 | "70% of the Internet" | PHP's share of sites with a known server language (69.2%). Measured unpatched hosts: about 1.57 million (Censys) |
These figures cannot be ranked against each other. One counts vulnerable servers, one estimated devices, one crashed machines and one a market share.
Sai Molige, a manager at the security firm Forescout, said PHP2Shell "could become a Log4Shell-scale incident."↗ Notice the word could. That's an honest warning. "Affecting 70% of the internet" was a verdict delivered before the evidence was in.
AI found it first. Fixing it still runs at human speed.
If the damage was limited, why did it feel like the floor had dropped away? Partly because of who found the bugs, and how fast everything moved afterwards.
The first of the two flaws had been half-seen before. In 2024 an audit of PHP by OSTIF and the security firm Quarkslab "rediscovered the same OOM issue", an out-of-memory bug, but nobody could prove it was exploitable, so it stayed in the code.↗ Turning it into a working attack needed what BCS, the UK's chartered institute for IT, called an "exceptionally complex chain of steps", previously considered "too difficult for human hackers to practically achieve."↗
Both are memory mistakes. In the first, PHP runs out of memory partway through setting up an incoming web request and stops while some of its internal data is only half-built. In the second, data from one request can survive after the memory holding it has been handed back, so the next request handled by the same worker can stumble into it. Security people call that a "use-after-free". Chain the two together carefully enough and a stranger's web request can end up running commands on the server. That chaining is the part that used to be too fiddly for people to do in practice.
Then, in August 2026, at least two teams found the problem independently within weeks of each other, both working with AI. Calif, a small security research firm, had been invited into OpenAI's "Patch the Planet" initiative. Its researcher found the first bug on 1 August and reported it to PHP on 11 August, with the second following on 21 August.↗ Calif lists OpenAI as a co-discoverer. On 19 August, Wiz found a flaw "using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol", its own tool plus two frontier AI models.↗ (Wiz is owned by Google, which completed its $32 billion purchase in March 2026.↗ Keep that in mind for Section IV.)
Calif's Ryan Austin was careful not to oversell it. "No special harness, or access to models that weren't generally available to everyone were used in the initial bug discovery," he wrote. And: "No model is simply capable of unearthing 'all bugs' with simple prompts. At least for now."↗ Both halves of that matter. The tools that found PHP2Shell are ones anybody can use. That includes the people who don't report what they find.
Which is where the clock comes in.
- Calif, working in OpenAI's Patch the Planet initiative, finds the first bug.
- Calif reports it to the PHP project.
- Wiz finds a flaw using its own tool plus Gemini 4 Argon and GPT-5.6 Sol.
- Calif reports the second bug.
- Amazon's honeypot network logs an exploitation attempt, four days before any fix is public.
- Mozilla blocks eight compromised eMudhra certificates in Firefox.
- Cloudflare switches on firewall rules for every plan, free ones included.
- PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 released. NSA advisory. Australia's ACSC issues a critical alert.
- Six European governments have taken sites offline to patch.
- First documented successful exploitation, on three honeypot servers.
- CISA adds both flaws to its Known Exploited Vulnerabilities catalogue.
- Alphabet shares fall 12.6%, their worst day since the 2004 listing.
Figure 2 · Twelve weeks from discovery to market shock. Red marks attacks and losses.
Amazon "observed a php2shell exploitation attempt against its MadPot honeypot network on October 17", four days before the public patch.↗ Someone else had found the hole too, or learned about it. After disclosure, things moved faster still. Cloudflare's chief executive, Matthew Prince, said attempts on his network went from thousands in the hours before disclosure to tens of thousands 45 minutes after it, hundreds of thousands within two hours, and eventually millions.↗
"Humans don't work at the speed of AI. That is the asymmetry right now."
Junfeng Yang, computer science professor, Columbia University · Fortune, 29 October 2026
Yang's broader point was that "AI is making the old vulnerabilities cheaper to discover and exploit."↗ That's the real shift, and it explains the gap between the panic and the damage. Finding a flaw is now cheap and fast. Fixing one still means a person logging in to a server, testing an update and restarting a service, millions of times over. This time the defenders were ready. Cloudflare had firewall rules running from 03:02 UTC on 21 October, hours before PHP's release, switched on automatically for every plan including free ones.↗ Governments chose the blunt option of switching things off. It worked, more or less.
The people building these tools say there's more coming. "We expect to find many more such issues over upcoming months," said OpenAI's president, Greg Brockman.↗ Ollie Whitehouse, chief technology officer of Britain's NCSC, warned of a "patch wave", which he described as "a rush of software updates that will need to be applied across the technology stack", and a "forced correction" of technical debt across all kinds of software.↗
The forced correction will land hardest on the software nobody is looking after. The PHP project says plainly that "PHP 8.1 and older no longer receive updates", and that PHP 8.2 "reaches end of life on 31 December 2026 and will receive no further security fixes after that date."↗ VulnCheck counted at least a million hosts running PHP versions that are no longer supported.↗ ANU's Sigi Goode put it neatly: "The bigger concern is the websites that are not down today."↗
PHP2Shell lives in the PHP software on your server, not in WordPress, your theme or your plugins. Updating WordPress won't fix it. Cloudflare's advice was explicit: "updating website code or a plugin(s) alone does not fix these vulnerabilities."↗
- Check your PHP version in wp-admin under Tools → Site Health → Info → Server, or ask your host. You need 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later, or a distribution package with the fix backported.
- On a managed host, ask them to confirm the runtime was patched. On your own server, update the PHP packages and restart the web server so the new version actually loads.
- A firewall rule helps, but Cloudflare itself says "Customers should patch their PHP repos even with WAF protections."
- If you're on PHP 8.2, plan the move to 8.3 or newer before 31 December 2026.
And once it's done, Securonix's Chris Jacob had good advice: "Do not let a successful patch close the ticket." Check your logs for signs of trouble from before you patched.↗
Not everyone agrees on where the blame should land. Joseph Steinberg, a cybersecurity expert and consultant, wants it on people: "if an AI goes out and hacks, the parties that own it should be held responsible criminally." He was scathing about the alternative framing: "The assertion that the AI is an autonomous being is insane."↗ Others are uneasy that the same companies selling the most capable AI are also selling the cure. Swinburne's Belinda Barnet: "It's like a massive weapons manufacturer offering us safer helmets."↗ Google DeepMind's head of Gemini security, Raluca Ada Popa, framed it the other way: "Using Gemini 4 Argon, the team at Wiz has shown why frontier AI is a game-changer for cyber defense."↗ They can all be right at once.
Google's worst day, and the slow leak
A week after the patches, on Thursday 29 October, Alphabet's Class A shares closed at $283.82, down from $324.89 the day before. That 12.6% fall was the largest one-day drop since the stock listed in 2004.↗ Yahoo Finance put the lost market value at $475 billion. Only Nvidia has lost more in a day, about $593 billion in January 2025.↗ Across October, Alphabet "shed about $758 billion in market value", its worst month since going public.↗
Let's be precise about the link to Black October, because it would be easy to cheat here. There isn't one. No analyst blamed the fall on PHP2Shell. The trigger was Alphabet's third-quarter results, released on 28 October. Revenue grew 25% to $127.6 billion, and Google Cloud more than doubled, up 103%. But earnings per share came in at $2.12, down from $2.87 a year earlier, dragged down by a net $8.2 billion loss in other income, driven by an $8.7 billion loss on equity securities. Capital spending reached $51.4 billion in the quarter, which pushed free cash flow to minus $9.1 billion.↗ The finance chief, Anat Ashkenazi, said capital spending would "increase significantly in 2027."↗
The number investors kept staring at, though, was Search. Revenue from Google Search and related products grew 12% to $63.35 billion. That sounds healthy until you see the trend.
Figure 3 · Google Search & other revenue, year-on-year growth. Sources: Alphabet Q3 2026 release; quarterly rates as tabulated by StockTitan.
Analysts didn't need long to reach for the obvious story. "The bears will argue this is the first quarter that AI is starting to seriously hurt their search business," said Pivotal Research's chief executive, Jeffrey Wlodarczak.↗ UBS said the results were "going to bring Search cannibalization fears right back to the forefront." D.A. Davidson's Gil Luria said investors "will now worry" the misses were "an indication that AI has finally come for Google."↗
Here's where the contrarian instinct has to cut both ways. Google's own explanation is not that people are deserting it. Sundar Pichai said search query growth is "the highest it's been in the last five years", and that "Queries in AI Mode are on average three times longer than traditional searches." Philipp Schindler, the chief business officer, blamed currency movements first ("It was the single largest driver of Search deceleration relative to Q2"), but conceded that "the strong growth in AI Mode queries had an impact because of the lower monetization we were seeing in AI Mode."↗ Ashkenazi had also warned that "we will begin lapping an acceleration in Search performance that began in the third quarter last year", which makes this year's growth look slower by comparison.↗
Put those together and the picture is clear enough. People are searching more, not less. But more of those searches are being answered by AI inside Google, and an AI answer earns less than a page of ads and links. The shift isn't away from Google. It's happening inside Google, and the cost of it lands on the websites that used to get the click.
That second half of the sentence has data behind it. SparkToro, using Similarweb's US panel, found that "In the first four months of 2026, a whopping 68.01% of Google searches ended without a click", against 60.45% in 2024, although its founder Rand Fishkin warns the two samples "aren't the same users or devices."↗ Pew Research tracked real browsing in March 2025: people who saw an AI summary clicked a regular search result on 8% of visits, against 15% for those who didn't, and clicked a link inside the summary itself on just 1%.↗ Chatbots send even less traffic onward. In the Reuters Institute's 2026 Digital News Report, "only 4 percent say they always or often click from AI chatbots to original sources", compared with 19% for search engines.↗
Figure 4 · Three studies, one direction. Bars share a 0–100% scale. The two zero-click figures come from different panels and are not a like-for-like comparison. Sources: SparkToro/Similarweb; Pew Research Center; Reuters Institute via The Decoder.
The counter-evidence deserves its turn. Search revenue is still growing. Only 1% of people in the Reuters Institute survey call AI chatbots their main news source.↗ A single bad quarter, a currency swing and a big paper loss on investments don't make a revolution. Anyone telling you October 2026 proves people have abandoned the open web is doing exactly what the 70% headline did: rounding a trend up into a verdict.
But step back and look at the two stories side by side, and the irony is hard to miss. A Google-owned security firm used frontier AI models, Google's Gemini among them, to expose decade-old cracks in the plumbing of the old, click-through web. A week later, investors punished Google over the fear that AI is draining the money out of that same web. The same technology is making websites cheaper to attack and cheaper to skip.
For anyone who runs a site, those two pressures meet in one place. The cost of keeping a website safe is going up: more patches, arriving faster, for software that used to sit quietly for years. The reward for running one, measured in visitors arriving from search, is going down. Big publishers can absorb that. Small ones, the independent blogs and community sites and specialist references that made the web worth searching in the first place, have the least room to do either.
So was Black October a harbinger? As a direction of travel, yes. The web's security now moves at machine speed, and its economics increasingly run through an AI answer rather than a link. As a description of what had already happened by 31 October, no. The internet didn't fall over, and people didn't stop searching. The panic number was wrong. The thing underneath it is real, and it's only just started.
Buy me a coffee