The Night the Internet Started Unplugging Itself

1

Japanese Prime Minister Sanae Takaichi’s social media account posted a message on Wednesday evening. The wording was direct: if patches cannot be applied in time, temporarily shutting down websites or other services may also be an effective way to reduce risk.

A few hours later, ANA suspended its website and app services, including boarding passes in Apple Wallet. Mitsubishi UFJ Financial Group and Nomura Securities shut down some non-core systems. Asahi Group, Keihan Holdings, Sega, and Bandai Namco joined the emergency maintenance list. Wikipedia displayed a notice saying that some support services had been proactively taken offline until they could be safely patched.

The Australian Signals Directorate issued a warning late Wednesday night. Some government websites remained inaccessible while awaiting fixes. The U.S. National Security Agency and the EU cybersecurity agency urged relevant organizations to respond immediately. Alibaba Cloud and Tencent Cloud sent customers alerts to upgrade PHP. South Korea estimated that about 110,000 internet assets in the country might be running affected versions.

These actions had one thing in common: no one waited for confirmation that an attack had occurred. In the first few dozen hours after the vulnerability was disclosed, “shut it down first” became the default option across time zones and industries.

2

PHP2Shell is described as an unauthorized remote code execution vulnerability in the PHP core runtime. Attackers do not need any login credentials. Some exploit methods take only a few seconds to run unauthorized software on an unpatched server.

What made this different was not how severe the vulnerability itself was. High-risk vulnerabilities appear every year. What was different was how it was found.

According to disclosed information, Ryan Austin, a researcher at the cybersecurity firm Calif, was auditing PHP source code when he used OpenAI’s GPT-5.6 Sol model to discover the vulnerabilities first. Google’s Wiz team subsequently independently found other exploit methods. Ami Luttwak, co-founder of Wiz, said this was “the most severe AI-related vulnerability discovered to date,” and that its complexity likely meant the flaw would never have been found without AI assistance.

The vulnerability had been hidden in the code for more than a decade. Human experts had read that code but had not found it. AI found it.

OpenAI described it as marking “a new stage in which AI can discover security vulnerabilities with internet-scale impact.” That sounds like PR language, but paired with another number, it becomes less reassuring: the total number of software vulnerabilities discovered globally in 2026 is expected to double compared with last year.

What does doubling mean? It means the number of vulnerabilities defenders must handle will become twice as large within a single year. But defenders’ staffing, budgets, approval processes, and testing environments will not become twice as large within a single year.

3

PHP powers about 70% of websites worldwide. WordPress is mainly written in PHP. That means government portals, financial institutions, airlines, gaming companies, e-commerce sites, and content platforms may all be standing on the same foundation.

Normally, this dependency is a source of efficiency. You build a site with WordPress; WordPress depends on PHP; PHP depends on a stack of extensions and libraries. Each layer saves you work. When something goes wrong, each layer becomes an amplifier of risk.

In its warning, the U.S. National Security Agency even advised organizations that could not patch immediately to disconnect systems from networks. The recommendation itself made one thing clear: before patches are in place, the safest network is one that is not connected to any network.

But “disconnecting” is only an emergency measure. The harder problem comes afterward: if AI will continue to discover deep vulnerabilities in foundational software continuously and at scale, must companies accept an operating environment in which they can be told to go offline at any time? If every widely used open-source component could become the next PHP, what can “trust” still be built on?

Supply chain security has been talked about for years, but most of the time the message has been “you need to know what is in your dependencies.” PHP2Shell adds another layer: knowing is not enough, because patching speed cannot keep up with disclosure speed.

4

Japanese cybersecurity consultant Toshio Nawa observed a shift. He said the scale and duration of website and service suspensions in Japan reflected a change in management mindset from “refusing to accept system downtime” to “refusing to accept any uncertainty.”

That sentence is worth pausing over. In the past, companies feared service interruptions most, because interruptions meant lost revenue and user complaints. Now companies fear “being held accountable after an incident” more. Weighing the two harms, shutting down the site has become the option that is easier to accept internally.

Why shut down sites at scale when patches exist? Because applying patches takes time. Compatibility must be tested, departments must coordinate, and there is the risk that “the patch itself causes problems.” In the window right after a vulnerability is disclosed, when information is incomplete and public attention is intense, the easiest decision for management is “shut it down first and reopen once we confirm it is safe.”

Nawa used a heavy phrase: “decision paralysis caused by fear of blame.” That may not apply to every company, but it points to a structural dilemma: when security decisions are simultaneously technical judgments, reputation management, and liability avoidance, shutting down a site is no longer a technical action but an organizational behavior.

Shutting down certainly has costs. But compared with “data breach, customer loss, and regulatory accountability after an attack,” shutdown becomes the option that is “at least not worse.” The problem is that if this logic becomes the norm, the reliability of internet services will be slowly eroded by security anxiety. Users will get used to “the website may go into maintenance at any time,” companies will get used to “take it offline first whenever a vulnerability appears,” and the entire digital economy will pay for it in operational efficiency.

5

After the PHP2Shell incident, cybersecurity-related software stocks in Asia generally rose. Shares of Trend Micro, NEC, Fujitsu, and FFRI Security all gained. Ryuta Otsuka, a strategist at Toyo Securities, said cybersecurity had become one of the themes attracting investor attention in the market that day.

The capital market’s reaction was honest: the more numerous and severe the vulnerabilities, the stronger the demand for security products and services. But behind this is an uncomfortable economics.

Attackers using AI face increasingly lower costs to discover vulnerabilities. Defenders deploying AI security capabilities must go through procurement, compliance, approval, integration, and training. Attackers can hit and move on; defenders must guard every inch of the wall. This asymmetry is not new, but AI has amplified it.

The harder problem is the speed at which vulnerabilities are “weaponized.” In the past, after a high-risk vulnerability was disclosed, attackers still needed time to write exploit tools. Now AI can assist in generating exploit code and even automatically search for ways to bypass mitigations. Defenders’ patching windows are compressed, security teams’ attention is diluted, and companies are forced to prioritize amid “patch fatigue.”

That explains why “pulling the network cable” becomes a rational choice: when defenders cannot win on speed, they can only buy time by “reducing exposure.” But this is not a long-term solution. A better answer is to shift security left, building a faster closed loop in software design, dependency management, runtime protection, and incident response, rather than hastily going offline after a vulnerability is disclosed.

6

For ordinary users, the most direct impact is service interruption. Airline apps cannot be opened, government websites cannot be accessed, and Wikipedia displays maintenance notices. The deeper impact is data risk: runtime vulnerabilities may allow attackers to read passwords, authentication tokens, and API keys from server memory. Fraud and phishing attacks may surge, because attackers will exploit public anxiety about “patches,” “upgrades,” and “security notices” to create phishing emails and fake update pages.

For companies, the impact has three layers. Operational: websites and APIs may be forced offline, interrupting customer service, transactions, and login flows. Compliance: regulators will ask whether patches were applied in time and whether security obligations were fulfilled. Strategic: companies will reassess dependence on a single technology stack, especially small and medium-sized businesses that rely heavily on WordPress, where migration and hardening costs will rise.

The judgment of Rashina Hoda, a scholar at Monash University, is worth noting: large banks and companies usually do not use PHP for sensitive transactions, but businesses whose websites rely heavily on service providers such as WordPress are particularly vulnerable. In other words, the distribution of PHP2Shell victims may be very uneven. Large institutions have the resources to respond quickly, while small and medium-sized businesses may struggle among “not knowing how to patch, not daring to shut down, and having no one to manage it.”

7

At 3 a.m., the forty-eighth hour after the patch went online.

The operations engineer stared at the monitoring screen. All services had been restored, there were no anomalous requests in the logs, the WAF rules had been updated, and PHP had been upgraded to the fixed version. Coffee had gone cold at the corner of the desk.

He did not click “restart.”

It was not that he did not want to. He did not dare to. A restart meant a new round of uncertainty, revalidating every dependency, every extension, every configuration. The vulnerability had been fixed, but no one could guarantee that “fixing it won’t cause other problems.”

The green indicator lights on the screen were on. He took a screenshot and sent it to the work group, with a one-word caption: “Stable.”

No one replied in the group. Everyone was waiting for the next vulnerability.