On October 21, 2026, government agencies and companies around the world began urgently fixing a vulnerability in the software that runs their websites. A flaw in PHP - the programming language used to build most modern web resources - could give attackers access to data and full control over a site. Warnings were issued by the US National Security Agency (NSA), cybersecurity agencies and software developers.
The hole was found by a researcher at the company Calif in August 2026 using an advanced artificial intelligence model from OpenAI. The find was reported to the nonprofit organization that manages PHP. However, information about the vulnerability leaked before patches - updates that close the hole - were released. According to Amazon Web Services representatives, hackers have begun "mass" attempts to exploit the flaw.
PHP is a programming language that runs a significant part of the internet. An estimated 70% of websites use PHP. It consists of two main parts: the core with libraries, and individual scripts - programs that process user actions and generate page content.
The current vulnerability lies specifically in the PHP core and related libraries. It is not a coding error in a particular website but a problem with the language itself. That means all systems without the update installed are vulnerable. Attackers can automatically find such sites and run an exploit program called PHP2Shell. An exploit is code that uses a vulnerability. In this case it gives "shell access" - the term used in cybersecurity for the ability to send commands directly to the computer running a site, bypassing its interface. This allows access to all of the resource's data.
The PHP2Shell story shows how useful AI is in cybersecurity. Previously, finding hidden bugs required large teams of specialists manually studying code. Modern AI models can analyze huge volumes of code in hours or days and find unusual patterns. The PHP vulnerability existed for more than ten years, and it was AI that helped discover it. However, the same tools can be used by attackers - for example, to quickly find vulnerable sites and automate the creation of exploits. This highlights the importance of security specialists using AI to find and responsibly disclose vulnerabilities.
Should ordinary users worry? PHP runs on remote servers, so regular site visitors do not need to download patches or fix anything on their own computers. But if you manage a website, blog or server - even a small one on a popular content management system such as WordPress - check the admin panel or ask your hosting provider whether the latest PHP update is installed. If the site is hosted by a third party, contact them and find out whether the vulnerability has been closed. Organizations that delay updating risk losing confidential data, facing disruptions or giving attackers a foothold for an attack on larger networks.
According to the authors of the material, the PHP2Shell case reflects a new reality: in a connected world, protecting web infrastructure is a continuous race. As AI tools become commonplace for both defenders and attackers, quickly installing updates remains the main protective measure.