Are we entering a new age of decade-old vulnerabilities?

Third of three. AI found a decade-old hole in PHP is how PHP2Shell was found. Fable, Mythos, and Google's cyber model is why that capability is gated. This is who was holding the data when the gate opened.

October 21, 2026 was a patch day that looked like an outage. Finland took government public-network services offline. The Dutch cyber agency took its own site down, and the Port of Rotterdam, the national government portal, the football association, five large political parties, and several hospital sites followed. France pulled local-government admin sites. Denmark shut services including the national school platform. The BBC and Edinburgh council took pages offline. Luxembourg suspended government services and reported no confirmed compromise.

PHP2Shell was already a finished chain, built with frontier models, and the patch diff was about to show everyone else where to look. Operators took sites down because a maintenance window looked longer than the race.

The quiet breach is the memory, not the shell

CVE-2026-109618 is code execution as the PHP worker, with no account on the site. CVE-2026-109619 is the quieter one: stale state on a long-lived worker can disclose process memory. Wiz says that memory can hold passwords, tokens, API keys, and certificates from other requests, or from the server. A store, a patient portal, and a bank's logged-in app can share that worker pool.

Installing the fixed runtime closes the next attempt. It does not answer whether an earlier request already read the heap. The patch commands and the "offline if you cannot patch" rule are in the October 21 fix post.

Banks were told to assume the exposure

No large bank has published a confirmed PHP2Shell intrusion. That sentence is the status of the reporting on October 21 and 22. It is a weak comfort, and the regulators did not treat it as one.

In Luxembourg, the financial supervisor, the CSSF, told institutions to treat every PHP-based service as potentially exposed until the running version was identified. Paperjam reported the regulatory consequence in plain language: a successful exploit that produces unauthorized access is a major ICT incident. It has to be filed under the Digital Operational Resilience Act, via CSSF Circular 25/893, or under Circular 24/847, depending on the institution. The CSSF also said no Luxembourg financial institution had announced an infiltration. The instruction to look backward still stands, because a patched worker does not restore a token that already left.

Magento and WooCommerce are PHP. Calif showed unauthenticated code execution on Magento as well as on WordPress, Drupal, and Joomla. A current plugin set leaves the runtime where it was. Payment sessions, admin cookies, and gateway keys live in the process the bug can read.

JPMorganChase joined Project Glasswing in April, months before this disclosure, to see defensive models early and on its own terms. The banks in that room are already hunting the next flaw. Everyone else is still one PHP version string away from the same worker memory.

Hospitals, councils, and the hosts that cannot move

The Dutch hospital sites are the healthcare version of the same decision. DeepMind says Wiz, with early access to Argon's defender track, had already used it to protect healthcare systems holding hundreds of thousands of patient records. A patient portal on an old PHP worker is the same kind of target, with a mailing list of medical data behind the page.

Mallory's October 20 reading of Shodan, limited to hosts that disclose a PHP version, found about 1.5 million of them, and 883,717 — about 59% — on PHP 8.1 or older. Those branches get no upstream fix. Some Linux vendors backport quietly, so php -v can lie. Appliances, agency sites, and shop hosts will still be answering on the old binary next month.

Source: Mallory's Shodan counts, via Cyber Security News, October 20, 2026.

Cloudflare was already seeing exploit attempts as the patches landed. Amazon's MadPot honeypot had been targeted before the public write-up. CISA had not confirmed exploitation in the wild when it published, and still told anyone who could not patch to take the service down. Attempts and precautionary outages are the record. A named breach of a bank core is not, yet.

The starting gun is the patch

Wiz's line is that complexity is no longer a meaningful barrier. Anthropic said the same thing in April, when Mythos Preview was finding zero-days that had survived decades of review: the cost of finding and using a flaw has collapsed, and the blast radius is banking, medical records, logistics, and power. CrowdStrike put the new interval at minutes.

A practitioner quoted by Paperjam called the disclosure the start of the race. The patched release can be diffed against the previous one with the same class of model that built the chain. PHP2Shell fit in a headline because the bugs reach back to PHP 5.4. Mythos Preview's thousands of operating-system and browser bugs are still mostly a disclosure pipeline. The next public one can be an image parser, a session library, a payment gateway, or a PHP binary inside a box that never appeared in an asset register.

A pull-request review will not upgrade PHP-FPM. It is where the next ordinary leak shows up, in the diff, before it is a CVE. ThinkReview does that on GitHub, GitLab, Azure DevOps, and Bitbucket. The public Gemini 4 Argon is one of the models in model selection. Fairwind and Mythos stay on the defender list.

Shutdowns are from CNBC, the BBC, and Paperjam. The CSSF and DORA reporting point is Paperjam's account of the Luxembourg response. Memory-disclosure impact is Wiz and PHP2Shell.com. Glasswing's scope is Anthropic's.