London: The global internet faced one of its most chaotic weeks in recent memory. On October 21 and 22, 2026, governments, banks, airlines, and major corporations across the world took the extraordinary step of shutting down their websites. The reason was not a physical attack or a massive data breach, but a critical software vulnerability discovered in PHP, the programming language that powers nearly 70 percent of the modern web.
The flaw was not discovered by human hackers, but by artificial intelligence agents. Once the details leaked online, hackers launched millions of attacks within hours, forcing a global race to patch systems before the internet suffered catastrophic damage.
What Exactly Happened?
PHP is an open-source scripting language used by millions of websites, including WordPress, Wikipedia, and countless government portals. The vulnerability, dubbed "PHP2Shell", was a server-side flaw that could allow attackers to execute malicious commands and potentially take control of web servers without authentication.
According to reports, the flaws were initially reported in August by cybersecurity firm Calif and OpenAI. Google-owned Wiz later identified additional exploitation methods. However, the details of the vulnerability leaked online on Tuesday, October 20, before official patches could be fully deployed.
The US National Security Agency (NSA) and the UK’s National Cyber Security Centre (NCSC) issued urgent warnings. They advised organizations to either install the security patches immediately or, if that was not possible, take their systems offline to prevent breaches.
The Global Shutdown
The response was unprecedented. From Tokyo to Helsinki, governments and corporations took their services offline as a precaution.
Europe: In France, local government websites, including the Paris Police Prefecture, were taken offline. The Netherlands suspended access to its DigiD digital identity service and the government portal Overheid.nl. Belgium’s foreign ministry and parts of Wikimedia (Wikipedia) also temporarily shut down systems.
Japan: Major companies, including brokerage Nomura, lender Mitsubishi UFJ Financial Group, airlines ANA, and East Japan Railway, suspended internet services. Japan’s National Tax Agency and the finance ministry also took services down.
United Kingdom: The UK government and the BBC temporarily took some web services offline.
Australia: The Australian Cyber Security Centre (cyber.gov.au) reported an outage affecting government websites.
Microsoft CEO Satya Nadella, speaking at an event in Germany, summed up the mood: "It was a long day and a long night, I know for all the IT and security folks... I’ve not seen anything like this in a long, long time" .
Millions of Hacking Attempts in Hours
While governments were shutting down websites, hackers were already exploiting the leak. Cloudflare, the massive cloud security firm, reported an astronomical surge in attacks.
Cloudflare CEO Matthew Prince posted on X that in the 10 hours before the vulnerability was publicly announced, they saw thousands of attempts to exploit it. Once the news broke, the numbers exploded: tens of thousands within 45 minutes, hundreds of thousands within 2 hours, and millions by the end of the day.
The attackers were not just human. Security experts noted that attackers were using AI to rapidly find and exploit vulnerable servers. "Details of these flaws became public before fixes were ready, and attacks have since been reported," said Madeline Lawrence, co-founder of Aikido Security. "So companies are racing to update against attackers who can use AI to exploit them. That's the whole race" .
The Rise of DDoS and Hacktivist Attacks
The PHP crisis was not the only cyber threat this week. The global chaos coincided with a wave of politically motivated cyber attacks.
In Azerbaijan, government agencies faced a week of large-scale cyber attacks. Nadir Novruzov, head of the State Service for Special Communication and Information Security, stated that the attacks were mainly DDoS attacks aimed at disrupting government information systems and preventing electronic services to citizens. They also observed attempts to gain unauthorized access to government email accounts.
In Italy, the Foreign Ministry website (Farnesina) was hit by a DDoS attack on October 8. The pro-Russian hacktivist group NoName057(16) claimed responsibility. The attack was effectively mitigated, but Italy announced it would collaborate with Romania and other EU states to formally attribute such attacks and hold the perpetrators accountable.
Saudi Arabia also saw outages: the Saudi eVisa portal and the Saudi Water Authority website were downed by DDoS attacks linked to a group called TheGarudaEye. South Korea’s Ministry of National Defense also reported a DDoS attack, though they confirmed the website was operating normally after blocking the attacking IPs.
Global Crackdown: UAE-Led Operation Nets $39 Billion
Amid the chaos of server shutdowns, there was some good news in the fight against cybercrime.
A massive UAE-led international operation involving law enforcement from 30 countries identified over $39 billion in funds and cryptocurrencies linked to scams. The operation, named "Confrontation Ghost", ran from July 1 to September 30, 2026. It resulted in over 960 arrests and raids on 29 fraud centers across the globe.
Authorities identified more than 15,500 victims and 3,500 suspects. They shut down over 570 social media accounts used to move money and manipulate victims, and identified over 4,126 bank accounts linked to fraud. Participating countries included the UAE, the UK, Canada, China, Myanmar, the Philippines, Singapore, Kenya, and Senegal. Private sector partners included Crypto.com, Meta, TikTok, Mastercard, and Huawei.
What This Means for the Average User
For everyday internet users, the PHP crisis is alarming, but you do not need to change your passwords. Cybersecurity officials confirmed that this is a server-side vulnerability, meaning it affects the servers that host websites, not the personal accounts of users. The primary action is for website administrators to patch their systems or take them offline.
However, this incident is a wake-up call. It shows how fragile the internet infrastructure is and how quickly AI can be used to exploit it. It also highlights the importance of using secure, up-to-date platforms.
For writers and bloggers, having a reliable and secure platform is essential. CandyWrite ensures a secure environment for your content, so you can focus on writing without worrying about server-level threats.
What Comes Next?
The immediate crisis is stabilizing as patches are deployed and systems come back online. But the aftermath will be long. Microsoft’s Satya Nadella emphasized that this event underscores the importance of building digital systems that can be maintained securely.
As AI continues to advance, both attackers and defenders will use it. The race is on. For now, the internet is back online, but the lessons learned from this week will shape cybersecurity strategy for years to come.
What do you think about the global response to this cyber crisis? Should governments have more power to shut down vulnerable systems, or is this a threat to internet freedom? Share your thoughts in the comments.
Join the conversation
Discussion0
Join the conversation. Sign in to leave a response or reply to comments.