Cybersecurity researchers using artificial intelligence models have identified two critical vulnerabilities in PHP, a programming language that powers approximately 70% to 75% of websites globally. The discovery, disclosed on Wednesday, October 21, 2026, prompted the PHP Foundation to release emergency security updates and led several government agencies in Europe and Asia to take their websites offline to prevent potential exploitation.
The security flaws, collectively nicknamed "PHP2Shell," had existed in the PHP codebase for at least a decade. While human researchers had previously noted unusual behavior in the code, the complexity of the bug made it difficult to develop a functional exploit manually. Researchers from the firms Calif and Wiz used AI tools, including OpenAI’s GPT-5.6 Sol and Google’s Gemini 4 Argon, to uncover the vulnerabilities. According to Wiz, the AI was able to perform the tedious, long-term task of identifying the flaw much faster than a human could.
The vulnerabilities allow for remote code execution, which the FBI's cyber division stated could permit hackers to take control of servers, install malware, or steal sensitive data. Amazon reported that its security team detected an attempt to exploit the flaws against a "honeypot" decoy system on October 17, four days before the public disclosure. Following the announcement on October 21, several governments, including those of the Netherlands, Denmark, Finland, and France, took various public portals and services offline as a precaution.
For the average internet user, the risk involves the potential theft of personal information stored on vulnerable websites, such as names, dates of birth, physical addresses, and email addresses. While visiting a PHP-based site does not automatically compromise a user's device, a breach of the website's server could expose their account data. The UK’s National Cyber Security Centre rated the danger at 9.2 out of 10, warning that the public release of the fix allows hackers to use AI to reverse-engineer the bug and launch automated attacks against servers that have not yet been updated.
Moving forward, the PHP Foundation and government agencies like the FBI and NSA are urging all organizations to install the emergency patches immediately. Those unable to apply the updates are encouraged to take their websites offline temporarily to prevent unauthorized access. The PHP Foundation released the technical details and update instructions on its official website on October 21. Cybersecurity experts indicate that a "race to exploit" is currently underway, and website owners will continue to be at risk until the new software versions are successfully deployed across their servers.