Governments and organizations around the world began scrambling on Oct. 21, 2026, to fix a vulnerability in software that runs their websites, a bug that could give hackers access to data and control of websites. The flaw in PHP, the programming language that powers much of today’s web, prompted urgent warnings from the U.S. National Security Agency, cybersecurity agencies and software vendors.
A researcher at Calif, a security research firm, found the flaw in August 2026 using an advanced artificial intelligence model from OpenAI. The firm alerted the nonprofit that manages PHP. However, word of the flaw leaked before the PHP organization released patches for its software, and according to Amazon Web Services officials, hackers began “broadly” attempting to exploit it.
The vulnerability has implications far beyond a single company or platform, because PHP is a key piece of software that helps run millions of websites. So, what is PHP, what role did AI play in uncovering the vulnerability, and should the average user worry?
PHP is a programming language that powers most websites. For a modern website to provide dynamic content, visual elements and searchable features, a program must run on the web server and take user input, whether that is entering a web address or clicking links and buttons. Estimates suggest that around 70% of websites run on PHP.
PHP operates on a web server in two main parts: the core PHP system – the engine and runtime libraries – and the individual PHP scripts, which are the custom programs that actually implement a website. When you interact with a website, PHP scripts run, take user input and produce the output your web browser displays.
The current security issue sits directly in the core PHP system and the libraries it uses. When a vulnerability exists at this deep level, it can allow an adversary to exploit the system. In this case, they can run unauthorized commands on the computer hosting the website, which allows attackers to access data and gain full control of the website.
This vulnerability is not a mistake in an individual website’s code. The issue lies in the core PHP system, making every unpatched system running PHP vulnerable. Since websites are accessible to anyone on the internet, adversaries can easily find PHP-based websites using automated tools. From there, they can run an exploit program that takes advantage of the vulnerability.
This exploit code is called PHP2Shell. This name comes from the fact that the exploit gives the attacker “shell access,” a cybersecurity term for direct command-line control of the computer running the website. Shell access bypasses the website interface, giving adversaries a window to enter commands and access all the website’s data.
What makes this vulnerability particularly interesting is how it was discovered. This exploit came to light through a process known as coordinated disclosure, in which cybersecurity researchers report the flaw to PHP developers before publicizing it.
This discovery shows the power of AI in cybersecurity. For decades, finding subtle software flaws required large teams of specialists manually reviewing code. Today’s AI systems can examine vast codebases and identify unusual patterns in hours or days. These models can analyze millions of lines of code in seconds, spotting subtle memory management bugs that human auditors might miss over decades of software development. The PHP vulnerability has existed in the core PHP code for over a decade, and AI helped researchers find it.
However, this also shows that attackers can use these same tools to locate and exploit vulnerabilities. The same reasoning capabilities that help security researchers find flaws first can also let attackers rapidly scan the web for vulnerable targets and automate the creation of tools to exploit the vulnerabilities.
This illustrates why it is so critical for security teams to use AI to find vulnerabilities and report them safely and actively. AI can also help release patches that mitigate these vulnerabilities.
Many government agencies, universities, hospitals and businesses rely on PHP-based systems. While individual internet users are unlikely to be directly affected, organizations that delay patching could expose sensitive data, risk having their operations disrupted or give attackers a foothold into larger networks.
PHP runs entirely on remote web servers. If you are an everyday internet user visiting websites, you do not need to download a patch or fix your personal computer.
However, if you manage a website, blog or server, even a small site built on popular content management systems such as WordPress, you should check your server administration panel or web host immediately to ensure your PHP software is updated to the latest patched version. If a third party hosts your website, check with them to see whether they have patched for these vulnerabilities.
The PHP2Shell discovery illustrates a new reality for cybersecurity. In our interconnected world, keeping web infrastructure secure is a continuous race. As AI tools become standard for both cyber defenders and online adversaries, maintaining fast patching habits remains our most essential defense.
This article is republished from The Conversation, a nonprofit, independent news organization bringing you facts and trustworthy analysis to help you make sense of our complex world. It was written by: Doug Jacobson, Iowa State University
Read more: Mythos AI is a cybersecurity threat, but it doesn’t rewrite the rules of the game What is DNS? A computer engineer explains this foundational piece of the web – and why it’s the internet’s Achilles’ heel Massive IT outage spotlights major vulnerabilities in the global information ecosystem
Doug Jacobson does not work for, consult, own shares in or receive funding from any company or organization that would benefit from this article, and has disclosed no relevant affiliations beyond their academic appointment.
