AI-Found PHP Flaws Threaten 70% of Websites as Governments Rush Emergency Patches
Updated
Updated · Mother Jones · Oct 21
AI-Found PHP Flaws Threaten 70% of Websites as Governments Rush Emergency Patches
3 articles · Updated · Mother Jones · Oct 21
Summary
PHP developers released emergency fixes after AI-assisted researchers showed how to exploit a decades-old flaw in software underpinning about 70% of websites, creating a risk of server takeovers, malware and data theft.
Google and OpenAI models helped uncover an attack path that had long been dismissed as too hard to use, turning a largely forgotten weakness into an urgent global patching effort.
Government agencies issued rapid alerts, and some public websites in Europe and Canada were temporarily taken offline so updates could be installed before attackers moved.
OpenAI called the bug one of the most consequential security issues in recent memory and said it has already found several other major vulnerabilities, with similar discoveries expected to rise sharply in coming months.
The episode adds to evidence that advanced AI is accelerating both cyberdefense and cybercrime, after reports that model-assisted attacks recently targeted 400 financial institutions across Latin America.
With AI handing hackers a roadmap to exploit PHP, is your website part of the 70 percent facing imminent takeover?
If AI can uncover decade-old internet vulnerabilities overnight, what other hidden backdoors are silently waiting to be weaponized?
Millions of sites run unsupported PHP versions; will the 'php2shell' flaw trigger the largest mass cyberattack in history?
PHP2Shell Emergency: How AI Unleashed the Largest PHP RCE Threat Since Log4Shell—Global Impact, Exploitation, and Defense
Overview
In October 2026, critical PHP core vulnerabilities known as PHP2Shell were discovered by Wiz Research using advanced AI tools. After confirming unauthenticated remote code execution on major platforms like Drupal and WordPress, the flaws were reported to the PHP security team. The situation escalated when a proof-of-concept exploit was accidentally published and container images with advance patches were released, allowing attackers to reverse-engineer the fix. This led to rapid public disclosure, emergency patch releases, and immediate exploitation attempts. Governments and security providers responded with advisories and protective measures, while administrators rushed to update and restart services to remove the threat from active systems.