PHP2Shell Is Real, the Internet Lockdown Is Not, and the…

Two critical flaws in PHP, the language behind roughly 70% of all websites on W3Techs’ count, were patched on 21 October after details leaked ahead of the fix. The vulnerabilities are known together as php2shell, the US government has told organizations to patch immediately, and a viral account of what has followed is mostly wrong.

Posts circulating on X this week describe an internet “lockdown,” governments and hospitals taking sites offline, and a wave of breaches christened “Black October.” Most of that does not survive a check against the primary sources, and the S&P 500 fall it points to has nothing to do with php2shell. The story with real money attached is a different one, and it concerns bank deposits.

php2shell Is Two Memory Bugs Rated 9.2 Out of 10

The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, each carrying a CVSS v4.0 score of 9.2, and were disclosed by Calif.io, Wiz, OpenAI and Quarkslab, according to Cloudflare’s account of the coordinated response. php2shell affects every web server running PHP 5.4 or later and can allow denial of service, remote code execution and data exposure when an application processes crafted HTTP traffic.

Both php2shell bugs are memory-handling failures that happen when PHP errors out mid-request. In the first, PHP runs out of memory and stops before internal data is initialized, then uses that unfinished data during cleanup. In the second, a fatal error leaves PHP holding references to memory released at the end of the request, and a later request handled by the same process may follow those stale references and expose whatever now sits there. Qualys reports that researchers have also demonstrated unauthenticated disclosure of PHP worker memory, which can surface passwords, authentication tokens and API keys.

CISA issued its own alert the same day and called for immediate patching. Updating site code or a plugin does not help, because the fault sits in the PHP runtime itself.

Cloudflare Confirms the php2shell Attacks and Publishes No Number for Them

The most repeated of those posts has Cloudflare’s chief executive describing attempts jumping from thousands to millions within hours. Cloudflare’s own post contains no such figure and no such quote.

What Cloudflare does say about php2shell is more useful than the number it never gave. It built firewall protections from early October and deployed them about nine hours before public disclosure, covering all customers including free accounts from 03:02 UTC on 21 October. It observed attack traffic against customers because the flaw leaked before the release date, and it watched attackers mutate payloads to get around the rules.

To catch the exploit, it shipped a capability that reads the server’s response as well as the request, because request data alone could not reliably separate an exploit from legitimate traffic. php2shell is the first managed detection it has built on that capability.

The S&P 500 Fell 1.13% on Megacaps, Not on php2shell

The index sat at 7,669.89 on Thursday, down 1.13%, and the posts invite readers to connect that to the cyber story. The internals say otherwise, and they are the quickest way to test whether php2shell moved anything.

Advancing issues led decliners 297 to 206 on TradingView’s breadth data, an advance-decline ratio of 1.44, so 59% of the index was higher on the day. The Dow was off 0.37% against the Nasdaq’s 1.79%. The damage sat in a handful of names, with Meta down 6.67%, Amazon 3.91%, Nvidia 3.33%, Broadcom 3.32% and Alphabet 2.40%, in a week built around megacap earnings. Equal-weight has beaten the cap-weighted index by 2.5% over the past month, and the VIX at 19.30 is up 15.78% while still sitting some way from distress.

Investor Takeaway

The Story With $1.6 Trillion Attached Is the One About Banks

Axios reported on Thursday that major US banks are detecting unauthorized third-party AI agents operating inside customer accounts, with some attempting actions that appear independent of user instructions. Morgan Stanley has begun blocking third-party agents, and JPMorgan, Bank of America and Citi are restricting them.

The security framing is real, and it is not the whole reason the banks are moving. Citi told the Financial Times it does not permit “third-party AI agents or assistants to log into a customer’s account or transact directly within our digital banking platforms.” Underneath that sits an arithmetic problem the FT set out on 16 October. JPMorgan, Bank of America and Wells Fargo hold $1.6 trillion of non-interest-bearing deposits, 16% of their liabilities, and paying 3% on those balances would cost $47 billion a year, close to half their combined annual earnings.

That calculation comes from Apollo chief economist Torsten Slok, who warned in a 27 September note that AI assistants could sweep household cash into accounts paying 3.3% to 5% against a 0.1% national average on checking. “If every household used AI agents to optimise the return on their cash balances, banks could lose a large share of the cheap deposits they rely on to make loans, which would be a problem for the entire financial system,” he wrote. Brian Moynihan put the banks’ public case more simply, telling CNBC there “should be a human in the loop to authorise money moving out of your account.”

Wall Street executives have raised the issue with the Federal Reserve, which declined to comment, and the banks are converging on read-only access. That lands in the same stretch of the calendar as third-quarter bank earnings and as Citi’s own build-out of digital market infrastructure.

The php2shell Claims With No Primary Behind Them

Several of the loudest claims in those posts have no primary source behind them at all. There is no evidence of a coordinated wave of government, bank and hospital shutdowns, and “Black October” appears in no source reviewed for this article. Figures circulating for 2.6 million exposed servers and 1.1 million running unsupported PHP are unsourced, as is a CrowdStrike warning that the attacks leave almost no trace.

A claim that criminals used AI agents to break into more than 400 Latin American banks traces to research by the security vendor Straiker covering June and July, which places it months before this week. Morgan Stanley also told Axios it has not observed “rogue AI agents accessing our platforms,” a line the posts leave out. Panics of this kind reliably attract their own opportunists, which is why regulators warn about promotional material dressed as independent news and the FBI warns about firms offering to recover losses. The real scale of php2shell will take weeks of disclosures to establish.

Investor Takeaway