A researcher at a security research firm used an advanced AI model from OpenAI to find a vulnerability in PHP’s core system, first reported by Fortune. The flaw can let attackers run unauthorized commands on servers hosting PHP sites, potentially exposing data and giving them full control of affected websites.
PHP runs on web servers, where scripts process user input and generate the output a browser displays. Estimates suggest around 70% of websites use the language, extending the flaw’s reach beyond any site’s custom code.
The vulnerability sits in PHP’s core system and its libraries, not in individual websites’ code. PHP2Shell, the exploit, gives attackers shell access, or direct command-line control of the computer hosting a site, where they can access data and take control.
The flaw is in shared PHP infrastructure, but exposure depends on whether each affected server has been patched.
The vulnerability had existed in PHP’s core code for over a decade. A researcher at a security research firm found it in August 2026 using the AI model and alerted the nonprofit that manages PHP.
The discovery followed coordinated disclosure, in which researchers report flaws to developers before making them public. Details leaked before the PHP organization released patches, and Amazon Web Services officials said hackers had begun broadly attempting to exploit the flaw.
The vulnerability prompted urgent warnings from the U.S. National Security Agency, cybersecurity agencies and software vendors. Governments and organizations around the world began scrambling to fix it on Oct. 21, 2026.
AI can help security teams find vulnerabilities and support patches, but attackers can use the same capabilities to scan for vulnerable targets and automate exploit tools.
Ordinary internet users are unlikely to be directly affected and do not need to patch their personal computers, because PHP runs on remote web servers. Organizations that delay patching could expose sensitive data, disrupt operations or give attackers a foothold in larger networks.
Website or server managers should check their administration panel or web host to ensure PHP is updated to the latest patched version. Site owners using third-party hosting should ask the provider whether it has applied the patches.