Bulgaria: Ai-discovered PHP vulnerabilities test management accountability under the cybersecurity act

Critical software vulnerability highlights growing expectations on management accountability and cyber resilience

On 21 October 2026, the organisation that maintains PHP, the programming language behind a large share of the world’s websites, released urgent fixes for two critical security flaws, officially catalogued as CVE-2026-109618 and CVE-2026-109619 and commonly referred to as “php2shell”. The flaws received a near-maximum severity rating because they allow an outsider, without any password or login credentials, to take control of an affected web server. Governments, public institutions and businesses across Europe and beyond temporarily took their websites offline after the EU’s cybersecurity response team, the US National Security Agency and other authorities advised organisations to update their systems immediately or disconnect them. Attempts to exploit the flaws began even before the fixes were published.

The incident is particularly significant because the flaws had gone unnoticed for more than a decade and were ultimately uncovered with the help of artificial intelligence tools. Researchers have described them as among the most serious ever found in PHP and early estimates suggest that millions of websites, online platforms and business applications may have been exposed. Fixing affected systems is the immediate priority. From a legal perspective, however, the incident also raises regulatory, governance and contractual questions that companies increasingly face under the EU cybersecurity framework, including NIS2, the Cyber Resilience Act (CRA) and related national legislation.

Why this matters for the technology and electronics sector

Technology and electronics businesses are especially exposed to events of this kind. Many operate customer-facing online platforms and e-commerce services, sell software or cloud-based services built on freely available open-source components and depend on outsourced hosting and IT providers. Many also manufacture connected devices and rely on long and complex supply chains involving numerous software providers.

A company does not need to write PHP itself to be affected. Corporate websites, customer portals, support tools and hosted services frequently run on widely used website and e-commerce platforms that depend on PHP. Updating the website platform alone may not be sufficient if the underlying PHP software has not also been updated. Companies are therefore exposed not only through their own systems but also through the software, suppliers, cloud providers and outsourced technology partners on which they rely.

AI-driven vulnerability discovery – time is of essence

The incident also signals a new phase in cybersecurity. Security researchers using AI tools were able to identify flaws that had remained hidden for years and that, according to the researchers, would have been extremely difficult to discover without AI. The same technology is, however, equally available to criminals. Once a fix is published, AI can help attackers determine what it addresses and target organisations that have not yet updated their systems. In this case, details leaked before the planned announcement, attempted attacks were reported days before public disclosure and tens of thousands of attack attempts were recorded within the first hour after the news broke.

For technology companies, this “race to exploit” sharply reduces the time between public disclosure of a vulnerability and the first attacks. A reliable process for identifying weaknesses, an up-to-date overview of the company’s systems, the ability to install updates quickly and effective monitoring and incident response arrangements are no longer merely good practice. They are increasingly the benchmark against which regulators and courts will assess whether a company acted with due care.

NIS2 and CRA implications: management responsibility and accountability

The lessons from this incident align closely with the objectives of the NIS2 Directive and the recently amended Bulgarian Cybersecurity Act. Under this framework, cybersecurity is no longer solely an IT matter. Management bodies must approve and oversee the company’s cybersecurity measures, ensure adequate resources and appropriate training and may be held personally liable for non-compliance. Entities affected by a significant incident must also notify the competent authority with an early warning within 24 hours and a more detailed report within 72 hours. Manufacturers face a parallel obligation. Since 11 September 2026, the CRA has required them to report security flaws in their products that are being actively exploited to ENISA, the EU cybersecurity agency, as well as the competent national authority within a similar timetable. This applies even where the flaw lies in third-party software incorporated into the product.

The PHP incident puts these obligations to a practical test. Boards should ask their internal IT team whether the company maintains complete and up-to-date records of its internet-facing systems, whether serious security flaws can be identified and assessed immediately and whether updates can be installed quickly enough. They should also confirm that there is a clear procedure, with defined decision-makers, for taking critical services offline and that the company understands which suppliers and third-party software it depends on.

These are governance questions as much as technical ones. The answers and the records showing how decisions were made are likely to be decisive if regulators, customers or business partners later scrutinise the company’s response.

Supply chain and third-party risk considerations

The incident is also a reminder that a company’s security is only as strong as that of its suppliers. Many affected organisations did not develop the vulnerable software themselves, as their exposure arises through websites, applications, cloud services or products supplied by third parties. Outdated software makes matters worse. Official fixes are available only for currently supported PHP versions, while older versions depend on workarounds or paid extended support. A significant proportion of servers is reportedly running versions for which no official fix exists.

NIS2 places increasing emphasis on supply chain risk, requiring organisations to assess and monitor the cybersecurity practices of suppliers and service providers. The amended Bulgarian Cybersecurity Act similarly requires organisations to evaluate supplier risks and the security of the technologies they use.

Technology and electronics companies should therefore review the security requirements they impose on suppliers, their own product development and quality controls and the arrangements for reporting incidents throughout the supply chain. Contracts deserve particular attention. Companies should check whether suppliers are obliged to install security updates within defined timeframes, notify incidents promptly and cooperate with investigations. They should also assess how warranties, service levels, limitations of liability, indemnities and force majeure provisions would allocate losses arising from an outage or data breach. Precautionary shutdowns may themselves trigger claims for service credits or damages, so both customers and suppliers should document their decisions and the steps taken.

Recommended actions

In light of the current situation, organisations should act promptly on several fronts, including:

• Identifying all PHP installations and PHP-dependent applications across their infrastructure.
• Applying available vendor patches without delay.
• Assessing whether unsupported or end-of-life software remains in use.
• Reviewing exposure arising from third-party applications, hosting arrangements and managed services.
• Monitoring for indicators of compromise and suspicious activity.
• Testing incident response and crisis management procedures.
• Ensuring senior management receives timely reporting regarding cyber risks and remediation efforts.
• Assessing whether reporting obligations under NIS2, the CRA or the GDPR have been triggered.

Looking ahead

The PHP vulnerabilities are likely to be remembered not only for their severity but also as a turning point in the impact of artificial intelligence on cybersecurity. Given that AI makes it faster both to identify security flaws and to explot them, regulators, customers and business partners will expect organisations to react more quickly, maintain operations under pressure and demonstrate sound cybersecurity governance. For technology and electronics companies, the message is clear: cybersecurity preparedness must be embedded in business strategy, supplier management and board-level decision-making. The ability to identify, assess and respond rapidly to new security threats is becoming a core element of corporate resilience, regulatory compliance and contractual risk management.