Data Analysis
A country without a data law faces the flaw in 69% of the web
Two flaws in PHP let a stranger take over a server without a password and read what it holds. PHP runs on 69.3% of websites. Bolivia faces the emergency with no data protection law and no authority to enforce one.
By Violeta Ayala — Tecnologa
A stranger sends a request to a website. They have no username and no password. With that request they run their own code on the server. That is what CVE-2026-109618 and CVE-2026-109619 allow, two flaws in PHP known as PHP2Shell. PHP rates each one 9.2 out of 10 and releases the fixes on 21 October 2026.
A server holds what an institution knows about its people: user accounts, passwords, forms, documents, payments. CNN reports that the flaws let attackers break into websites and read memory that can contain sensitive information, such as passwords. The FBI warns that they raise the risk of sensitive data and whole networks being compromised. Security firm Imperva documents full code execution, file reads and exposure of server memory.
PHP runs on 69.3% of websites whose server-side language is known, according to W3Techs. WordPress, Drupal and Joomla run on PHP. The flaw also reaches equipment that protects networks. Palo Alto Networks confirms that all versions of PAN-OS and Panorama, the system behind its firewalls and its management console, are affected. As at 22 October it has no fixed releases.
The attacks have already started. Amazon detects an exploitation attempt on 17 October, four days before the announcement. Matthew Prince, chief executive of Cloudflare, counts tens of thousands of attempts in the first 45 minutes after the announcement and millions by that night.
The world switches sites off
On Wednesday the 21st, France’s Interior Ministry puts all its websites exposed to the flaw into preventive maintenance. The website of the Netherlands’ cybersecurity agency goes offline. Finland cuts public government network services. Denmark suspends its national school communication platform. The Wikimedia Foundation, which runs Wikipedia, takes part of its systems down as a precaution.
In Japan, Prime Minister Sanae Takaichi says: “If it is difficult to apply the fix patch promptly, temporarily suspending websites and similar measures can be considered an effective way to reduce risk.” In the United States, the FBI recommends taking websites offline if they can’t be updated immediately.
From audit to attack
- A PHP developer notices one of the problems during the first external audit. No way to exploit it is found. The fix stalls for months.
- Calif, working with an OpenAI model, reports the flaw to PHP. OpenAI reports the same issue that day.
- Wiz, a Google Cloud company, reports its findings.
- Amazon detects an exploitation attempt, four days before the announcement.
- The identifiers of the two flaws leak on forums and social media. A proof-of-concept video against real targets is published by mistake.
- PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Governments in Europe and Japan take websites offline.
- Cloudflare records millions of exploitation attempts.
- Bolivia’s CGII publishes two alerts.
Bolivia, without a data law
Bolivia has no general personal data protection law. There are two bills, one from AGETIC, the state’s e-government agency, and one from Fundación InternetBolivia.org. Neither is law. No authority supervises how institutions and companies store people’s data. The Constitution offers the acción de protección de privacidad, a court remedy each person has to bring on their own.
Data held by the Bolivian state already circulates. In July 2024, the Observatorio de Delitos Informáticos de Bolivia (ODIB) warns of a database with personal information on 12.5 million citizens offered on social media. In October 2025 it reports a mass leak of student data from Universidad Autónoma Tomás Frías, covering 2004 to 2025. In November 2025 it reports the alleged sale of 10,335,788 records, which it attributes to the Registro Central de Ciudadanos and the Ministry of Health. According to the ODIB, that figure represents “practically the entire registered population of the country”.
The reports on those cases record no official confirmation or denial. All three leaks predate PHP2Shell and have no known connection to PHP.
The state’s response
Panama publishes its alert on 21 October. Chile publishes alert AVC26-00740. In Bolivia, the Centro de Gestión de Incidentes Informáticos (CGII), which operates inside AGETIC under the Ministry of the Presidency, publishes two alerts dated the 22nd.
The first says, in Spanish: “The PHP security team scheduled the release of an emergency update to fix these vulnerabilities.” PHP releases that update on the 21st.
The CGII rates both alerts “Alta”, high. PHP calls both flaws critical. In May, the CGII rates a flaw in DAEMON Tools Lite, a program for mounting disk images, as “Crítica”, critical. On the CGII’s home page, the alert before the PHP2Shell ones is dated 29 May.
The second alert states that the patches “can be evaded in certain contexts”. It cites no source for that claim. At the time of writing, PHP has published no new version. Its notice says updating is the only safe choice.
The CGII asks institutions to inventory their PHP installations, review their logs and report any incident to it. It does not say how many state institutions have updated, or whether it received the confidential notice that, according to OpenAI, reached governments before the announcement. sala.red found no public reports of Bolivian state websites taken offline over PHP2Shell.
Those who can’t update
A count from 20 October, which the CGII attributes to Shodan, identifies 883,717 internet-facing servers running PHP 8.1 or earlier. TuxCare, using data from Mallory, calculates that these are about 59% of the servers that show their version. PHP publishes no official releases for those branches.
A media outlet, an NGO or a small business with its website on shared hosting cannot fix PHP on its own either. Updating WordPress or its plugins does not resolve the flaw. The fix depends on the hosting provider.
Who pays
One of the two flaws first appears in 2024, during PHP’s first external security audit. The security team drafts several fixes, each with a cost, and the work stalls for months. In August 2026, researchers at Calif and Wiz, helped by artificial intelligence, show it can be used to take over servers.
“With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work.”Wiz Research
“We won’t pretend otherwise: the delay was a structural failure, caused by both the security team’s decision process and its lack of resources.”PHP Foundation, 21 October 2026
The PHP Foundation keeps the language secure with a small group of paid developers and some volunteer help. It now asks the companies, hosting providers and governments that use PHP to fund that work.
ANSSI, France’s cybersecurity agency, counts more than 600,000 servers running PHP on the French internet. The CGII publishes no figure for Bolivia.
The PHP Foundation asks governments to pay for PHP’s security. The CGII asks institutions to review their logs.
Sources
- PHP, PHP 8.4.27 (security release announcement), 21 October 2026.
- CNN, “Websites shut down globally after AI finds cybersecurity flaw affecting 70% of the internet”, 21 and 22 October 2026.
- PBS NewsHour / AP, “AI discovered a software vulnerability that could impact 70% of websites worldwide”, 22 October 2026.
- Imperva, “PHP2Shell: When PHP Runs Out of Memory at the Wrong Moment”.
- W3Techs, PHP usage as a server-side language, data as at 22 October 2026.
- Help Net Security, “PHP2Shell: Critical PHP vulnerabilities patched, update now!”, 22 October 2026 update on Palo Alto Networks.
- Revista E&N, on CSIRT Panamá, Amazon and Cloudflare, 22 October 2026.
- ActuIA, on ANSSI and France’s Interior Ministry.
- Universidad de Valparaíso, analysis by Marco Aravena, 22 October 2026.
- Opinión, “¿Quién se queda con tus datos? Bolivia todavía no tiene una ley que obligue a responder”, 16 September 2026.
- eju.tv, “Advierten liberación de información sensible de base de datos de ciudadanos bolivianos”, 21 July 2024.
- ODIB, “Alerta: Base de Datos de Ciudadanos de Bolivia Estaría a la Venta en la Dark Web”, 25 November 2025.
- ODIB, alert list, including the UATF student data leak of 23 October 2025.
- CGII-AGETIC, “Vulnerabilidades críticas de ejecución remota de código en PHP php2shell”, 22 October 2026.
- CGII-AGETIC, “Refuerzo de monitoreo y configuración por incidencias de parches post-actualización de PHP2Shell”, 22 October 2026.
- CGII-AGETIC, home page and alert list, accessed 23 October 2026.
- Latent Space, on Patch the Planet and the confidential notice to governments.
- TuxCare, “TuxCare Patches php2shell for the PHP Versions Upstream Left Behind”.
- Meow Apps, “PHP2Shell: what it is, and what to do on your WordPress site”.
- The Next Web, “PHP knew about one of the flaws in 2024 but could not agree a fix”, 21 October 2026, quoting the PHP Foundation.
- The New Stack, “AI found a critical PHP flaw. The bigger failure began in 2024.”
- Recorded Future, “PHP2Shell Exploitation: Two Critical PHP Flaws Explained”.
