AI-Found PHP Flaw Puts 70% of the Web in Hackers' Crosshairs

A flaw in PHP discovered by an AI model from OpenAI exposed up to 70% of the world's websites to potential takeover, and hackers began exploiting it before a patch shipped.

Governments and organizations scrambled on Oct. 21, 2026 to fix the vulnerability, which could give attackers access to data and full control of websites. The U.S. National Security Agency, cybersecurity agencies and software vendors issued urgent warnings.

A researcher at Calif, a security research firm, found the flaw in August 2026 using the advanced OpenAI model. The firm alerted the nonprofit that manages PHP. But word of the flaw leaked before the PHP organization released patches, and Amazon Web Services officials said hackers began "broadly" attempting to exploit it — a four-day head start on defenders.

What is PHP and why does it matter?

PHP is a programming language that powers most of the modern web. It runs on web servers, taking user input — a typed address, a clicked link — and producing the content a browser displays. Estimates put around 70% of websites on PHP, according to Reuters.

The language operates in two main parts:

• The core PHP system: the engine and its runtime libraries
• Individual PHP scripts: the custom programs that implement each website

Government agencies, universities, hospitals and businesses all rely on PHP-based systems.

What does the vulnerability actually do?

The flaw sits directly in the core PHP system and the libraries it uses, not in any individual website's code. That distinction is what makes it dangerous: every unpatched system running PHP is vulnerable.

An attacker who exploits the bug can run unauthorized commands on the computer hosting a website. That grants access to data and full control of the site.

The exploit code is called PHP2Shell. The name reflects what it delivers: "shell access," the cybersecurity term for direct command-line control of the machine. Shell access bypasses the website interface entirely, opening a window for adversaries to enter commands and reach all of the site's data.

Because websites face the open internet, adversaries can find PHP-based targets with automated tools and fire exploit programs at scale.

How did AI find a bug humans missed for a decade?

The vulnerability had existed in the core PHP code for over a decade before AI helped researchers find it. The discovery came through coordinated disclosure — researchers reported the flaw to PHP developers before publicizing it.

That timeline illustrates how sharply AI has changed vulnerability research. For decades, finding subtle software flaws required large teams of specialists reviewing code by hand. Today's AI systems can analyze millions of lines of code in seconds and spot unusual patterns in hours or days, including subtle memory management bugs human auditors might miss across an entire career of software development.

The sword cuts both ways. The same reasoning capabilities that let defenders find flaws first also let attackers rapidly scan the web for vulnerable targets and automate the creation of exploit tools.

That asymmetry is why security teams need to use AI to find vulnerabilities and report them safely, and why AI-assisted patching — such as the fixes highlighted by CISA — matters.

Should everyday users worry?

Mostly, no. PHP runs entirely on remote web servers, so individual internet users don't need to download a patch or fix their personal computers.

Website operators are a different story. Anyone managing a site, blog or server — including small sites built on content management systems like WordPress — should check their server administration panel or web host immediately to confirm their PHP software runs the latest patched version. If a third party hosts the site, ask them directly whether they've patched.

Organizations that delay face exposure of sensitive data, disrupted operations, or a foothold for attackers into larger networks.

PHP2Shell marks a new reality: as AI tools become standard equipment for both cyber defenders and adversaries, fast patching habits remain the single most essential defense for web infrastructure.

By Amara Osei