The PHP crisis broke on a Wednesday, but the interesting number came out on a Thursday from a British minister. Kanishka Narayan, the UK's AI minister, told the BBC — before the PHP flaw became public knowledge — that the government had previously used AI to find hundreds of vulnerabilities in its own systems. The headline figure is 500. He was answering for a crisis that AI had just caused: two critical flaws in PHP, discovered by GPT-5.6 Sol and Gemini 4 Argon, now called PHP2Shell, which have taken 32 government services offline and left four more partially unavailable, and had Finland, the Dutch government, and part of Wikipedia dark for the same reason. The coincidence is not an accident. The story is about a world where both sides of a security breach are now models, and where the discovery of a bug is no longer a slow human act. The question the minister's number answers is whether governments are even keeping up with their own attack surface.
What PHP2Shell actually is
The two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are unauthenticated remote-code-execution flaws in the PHP core itself, not in a framework or a misconfigured server. They reach back to PHP 5, which shipped in 2004, so essentially every version in production is in scope. Wiz, the security firm that helped surface the issues, estimates PHP powers roughly 70 percent of the web. That is not a typo. The language is the quiet layer under WordPress, Drupal, Joomla, Magento, shared hosting, and a large pile of software that does not even advertise that it runs PHP. The PHP Foundation has only patched the newest releases. Anyone still on PHP 8.1 or older is told to upgrade, which for many organizations is a multi-week project, not a patch day.
How AI found it, and how it got out
Calif, a security firm working under OpenAI's Patch the Planet program, found one of the flaws using GPT-5.6 Sol. Wiz found both independently, using its Wiz Atlas platform alongside Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol. An OpenAI researcher also independently found the issue around the same time. The coordinated disclosure ran for two months and five phases, involving the PHP Foundation, Wiz, Cloudflare, CISA, and the White House. OpenAI called the discovery one of the most impactful security issues in recent memory. Then the details leaked on social media on Tuesday, and the whole calm, coordinated process collapsed into a rushed public warning, which is the moment governments began pulling their sites offline as a precaution.
The race was already over
The disclosure process was two months, but the attackers had a head start. AWS said it observed active exploitation of the flaws four days before they were made public. Cloudflare's Matthew Prince described the curve on his network: thousands of attempts in the ten hours before the announcement, jumping to tens of thousands in the 45 minutes after it, hundreds of thousands within two hours, and millions by the end of the day. The attack curve is a textbook zero-day-to-public exploit, and the reason the window closed so fast is that the exploit is no longer a human-written, one-off script. Wiz's point is that large language models now adjust exploits automatically across different PHP versions, configurations, and memory layouts, which means a flaw that once was impractical to weaponize at scale has become a viable target. The barrier between finding a bug and farming it has been lowered, and that is a change that is not going to be reversed. NCC Group's Matt Hull put it the way the industry is starting to: a few years ago, an attacker took weeks to exploit a vulnerability. Now it is days, or hours.
The 500 number, and what it means
The reason Narayan's number matters is the framing. The government has been running its own AI scan against its own systems for some time, and it has come up with 500 findings. That is not a failure state. That is what a defense that keeps pace with the offense looks like when both are models. The 500 vulnerabilities are the residue of a running process, and the PHP2Shell crisis is the first time that process has collided with a public, AI-discovered, AI-weaponized event at national scale. The minister's admission is the government telling the public that the attack surface it has been managing is not a small, bounded list. It is a number in the hundreds, growing, and being probed by the same class of tool that is now probing it from the outside. The 32 government services that went offline are not evidence of a breach. The Whitehall line is that none of them were confirmed compromised. They went dark for the same reason Finland and the Netherlands went dark, which is that the patch is hard to roll out and the exploit is trivial to try. The risk is not that the government was hacked. The risk is that it was forced to choose between being up and being safe, and picked safe, and then had to explain to the public why its services were not there when it needed them.
What the next two weeks look like
The PHP Foundation has a coordinated-disclosure track record, and it is a good one. The two-month, five-phase process with Wiz, Cloudflare, CISA, and the White House is the model that OpenAI is now trying to make repeatable for AI-driven security discoveries. The problem is that the model assumes the discovery is contained, the disclosure is clean, and the patch is fast. None of those held this time. The leak broke the containment, and the patch is slow because it is a language upgrade, not a security update. The next two weeks are going to be a race between the organizations that can find and upgrade their hidden PHP instances and the attackers who can find them first. The 500 number is the starting point for the government's own version of that race, and the PHP2Shell crisis is the event that made it visible.
What it means
The first thing it means is that vulnerability discovery is now an AI event, and the human part of the pipeline is the slow leg. Finding the flaw took a few weeks of model time. Writing the patch, running the disclosure, coordinating five parties across two months, and deciding which sites to take dark are all human-speed work. The damage happens in the gap between the two, because the exploit moves at model speed and the patch moves at meeting speed.
The second thing it means is that the 500 is a status, not a scandal. A running defensive scan that keeps producing findings in the hundreds is what a defense that is keeping pace looks like. The number only becomes a problem when an external event lands faster than the patch curve, and PHP2Shell is the first time that has happened at national scale, with a leak in the middle. The cost of the correct response is that the public saw its services disappear, and had to be told that the absence was the safer option.
The third thing it means is that PHP is probably the last fundamental layer whose failure looks like this. The next one is a framework, a library, a model, or an agent, and the patch will be even slower, because the attack surface will be more distributed. The exploit curve is already measured in hours. The patch curve is measured in weeks. The gap between the two is the whole problem, and the 500 is the government's own admission that it is living inside that gap.
What it does not mean is that the UK government was breached, or that PHP is going away. The official line is no confirmed compromise, and Whitehall extended that to the wider public sector. And PHP is 22 years old, under roughly 70 percent of the web, and not going away this week. The crisis is not the end of PHP. It is the first demonstration, at national scale, that the human-discovery era is over.
Hot takes
1. The 500 is the number that should have been the headline. The 32 services, the OBR, the DVLA, the councils, Wikipedia's dark, Finland, the Netherlands, the NSA advisory, Japan's prime minister asking people to check their websites. All of that is the event. But the 500 is the underlying fact: the government has been running an AI scan against its own systems, and the scan's answer is in the hundreds. That is the actual state of the defense, and it is the number that should worry anyone, because it is the gap, and the gap is the window, and the window is measured in hours now.
2. This is not a PHP story. It is the end-of-the-human-discovery-era story. Discovery: AI. Exploitation: AI. Weaponization across versions and configurations: AI. The only human work left is the patch, the disclosure, the coordination, and the decision to go dark, and all of it is slow. Wiz said it plainly, that vulnerabilities that once seemed impractical to exploit at scale are now viable targets, because the models remove the adaptation work. The asymmetry is permanent, and the 500 is the government's version of the same asymmetry.
3. The leak is the thing nobody will talk about, and it is the part that matters. Two months and five phases of coordinated disclosure with the PHP Foundation, Wiz, Cloudflare, CISA, and the White House is the model OpenAI wants to repeat. Then the details hit social media on a Tuesday, the containment broke, the exploit curve started, and the patch curve did not keep up. The failure mode is not the vulnerability. It is the containment, and the containment is the thing that is going to break next time, with a smaller library and a slower patch, and a bigger dark.
The bottom line
PHP2Shell is the first time an AI-discovered vulnerability took governments down, and the governments are the 32 services, the OBR before the Budget, the DVLA, the councils, the dark Wikipedia pages, Finland, the Netherlands, the NSA advisory, Japan's prime minister telling citizens to check their own websites. And in the middle of it, the UK's AI minister revealed that the government's own running scan has found 500 vulnerabilities in its own systems. The 32 went dark because the patch was slow and the exploit was fast. The 500 exist because the scan is honest. Both numbers are the same fact: the defense is a running process, the offense is now a model, and the gap between the two is measured in hours.