OpenAI-Aided Researchers Uncover Critical PHP Flaw Affecting 70% of Websites
Updated
Updated · The New York Times · Oct 21
OpenAI-Aided Researchers Uncover Critical PHP Flaw Affecting 70% of Websites
3 articles · Updated · The New York Times · Oct 21
Summary
Security researchers using OpenAI’s advanced AI models found critical vulnerabilities in PHP, prompting urgent warnings from the Trump administration and governments in Europe and Asia.
PHP underpins about 70% of websites and web applications, and patches released Wednesday could help attackers reverse-engineer the flaws before organizations secure their systems.
Successful exploits could let hackers seize control of servers, steal private data and deface websites, raising the risk of broad disruption for businesses, governments and consumers.
The NSA and other agencies told organizations to patch immediately or take systems offline; some European government sites already suspended services.
The disclosure intensifies six months of concern that increasingly capable AI could sharply accelerate cyber offense unless software defenses improve.
With AI handing hackers a roadmap to exploit PHP, is your website part of the 70 percent facing imminent takeover?
If AI can uncover decade-old internet vulnerabilities overnight, what other hidden backdoors are silently waiting to be weaponized?
Millions of sites run unsupported PHP versions; will the 'php2shell' flaw trigger the largest mass cyberattack in history?
PHP2Shell Emergency: How AI Unleashed the Largest PHP RCE Threat Since Log4Shell—Global Impact, Exploitation, and Defense
Overview
In October 2026, critical PHP core vulnerabilities known as PHP2Shell were discovered by Wiz Research using advanced AI tools. After confirming unauthenticated remote code execution on major platforms like Drupal and WordPress, the flaws were reported to the PHP security team. The situation escalated when a proof-of-concept exploit was accidentally published and container images with advance patches were released, allowing attackers to reverse-engineer the fix. This led to rapid public disclosure, emergency patch releases, and immediate exploitation attempts. Governments and security providers responded with advisories and protective measures, while administrators rushed to update and restart services to remove the threat from active systems.