AI discovers severe PHP bug affecting up to 70% of the web

Critical vulnerability found in language powering most websites

A security researcher using an AI model discovered a serious bug in PHP, the software language used to build the backends of up to 70% of the world's websites. The vulnerability, known as PHP2Shell, allows an attacker to run code on a web server without needing a login. Because PHP runs on servers that power web content, this bug puts a large portion of the internet at risk of being hacked. Emergency fixes for the newest versions of the software were released on October 21, 2026, but many older websites remain unprotected.

Key facts about the PHP2Shell threat

• The bug: Two flaws (CVE-2026-109618 and CVE-2026-109619) let attackers exploit a server's memory to execute harmful code.
• The discovery: The bug was found in August during an audit by a partner in OpenAI’s 'Patch the Planet' program, using OpenAI's GPT-5.6 Sol model.
• Immediate impact: Cloudflare reported that live attack methods affected all its customers, including those on free plans.
• Government response: Finnish and Dutch government websites, including national portals and local councils, were taken offline as a precaution.

What the developers and AI researchers reported

PHP developers shipped emergency patches for versions 8.2, 8.3, 8.4, and 8.5 on October 21, 2026. The developers also began rolling out 'backports,' which are security updates for older software versions, to releases 7.4 through 8.1. However, the official fixes only cover PHP 8.2 and newer. This means that 27% of websites, which still run PHP 7, and 7.7% of websites running the ancient PHP 5, remain without a patch. Furthermore, one estimate suggests that more than 800,000 internet hosts run a version of PHP so old that they will never receive a fix.

Thai Duong, the CEO of Calif, told the Wall Street Journal that the bug had been flagged by researchers decades earlier but was dismissed because it was too difficult to exploit. However, the AI model found a way to attack the server's memory in just a few dozen requests. Wiz, a security company owned by Google, confirmed the flaws and called this the most severe vulnerability found by AI so far.

Global response to the security alert

Major internet companies reacted quickly to the threat. Cloudflare, which provides security and hosting services to many websites, put out a stopgap measure overnight and later announced more permanent patches. GoDaddy, a popular web hosting provider, told its customers to upgrade their software immediately. In the Netherlands, the country's main government website and parliament sites were taken offline, along with local municipal sites in some regions. In Finland, the state IT center shut down several government web services.

What is still unclear

As of the time of reporting, it is not fully known how many websites have been successfully hacked by exploiting this specific bug. While the risk to unpatched servers is high, the exact number of compromised sites remains unconfirmed.

• Protos