AI Tools Uncover a Critical PHP Vulnerability: The Race to Patch a Potentially Internet-Wide Security Risk

Artificial intelligence is changing cybersecurity on both sides of the battlefield. AI-assisted tools are helping researchers uncover dangerous software flaws, but the same capabilities could help attackers discover and exploit vulnerabilities before developers have time to respond.

The discovery of a serious vulnerability in PHP, one of the technologies underpinning millions of websites, highlights a growing challenge for the cybersecurity industry: the window between finding a software flaw and exploiting it may be shrinking as AI accelerates vulnerability research.

The claim that the vulnerability could affect 70% of the internet makes the story particularly striking. However, that figure needs careful context. PHP's widespread use does not automatically mean that 70% of websites are vulnerable to a single flaw. The actual risk depends on the affected PHP versions, the software configurations involved, and whether the vulnerability can be exploited in real-world environments.

What is PHP2Shell, and why does it matter?

PHP is a server-side programming language that processes requests, handles application logic, and helps websites communicate with databases. It is widely used in content management systems and web applications, including WordPress, Drupal and Joomla.

The newly disclosed vulnerabilities, collectively dubbed PHP2Shell, affect PHP's core engine rather than just one website platform. According to research published by cybersecurity company Wiz, the flaws involve memory-safety weaknesses that can expose sensitive process memory or, under affected conditions, allow attackers to execute code remotely without authentication.

Wiz Blog

That distinction is crucial. A vulnerability limited to one plugin or application may affect a relatively narrow group of users. A flaw in a widely deployed programming language can potentially expose many different applications and hosting environments simultaneously.

Researchers reported that the vulnerabilities affect PHP releases spanning many years, with the precise exposure depending on the version and issue involved. Wiz also identified more than one weakness, making this a coordinated security response rather than a routine software update.

Wiz Blog

What could an attacker do?

If a vulnerable server is successfully exploited, the consequences could include:

• Remote code execution: Running unauthorized code on the affected server.
• Data theft: Accessing sensitive information, credentials, authentication tokens or other data available to the compromised process.
• Website compromise: Altering website content, installing malicious components or disrupting services.
• Further intrusion: Using a compromised server as an entry point to investigate or attack other systems, depending on its permissions and network access.

These are potential consequences of exploitation, not evidence that every PHP-powered website has been compromised. Actual impact depends on the vulnerable component, system configuration, permissions and security controls.

Wiz Blog

AI changed how researchers found the flaw

One of the most significant aspects of PHP2Shell is not simply the age or severity of the underlying code defects. It is how researchers were able to investigate and demonstrate them.

According to OpenAI, the discovery formed part of its Patch the Planet initiative, which uses AI-assisted security research to identify and help remediate vulnerabilities in important open-source infrastructure.

The security firm Calif used OpenAI's GPT-5.6 Sol to uncover a critical flaw in August 2026. Researchers at Wiz independently investigated PHP and identified related vulnerabilities using a combination of AI models and security tools. The researchers subsequently coordinated with PHP maintainers and other security organizations to validate findings and prepare fixes before public disclosure.

OpenAI

The discovery is particularly notable because the underlying weaknesses had existed for years. Their presence in a mature, widely reviewed codebase illustrates an important limitation of traditional security practices: code can be extensively examined without every complex vulnerability being understood or successfully exploited.

AI-assisted research can help bridge that gap by examining source code, tracing interactions between functions, generating hypotheses about memory corruption and testing potential attack paths. Researchers can use these capabilities to explore complicated sequences that might otherwise demand substantial time and specialist expertise.

In this case, AI did not simply identify suspicious code. It helped researchers establish how the underlying weaknesses could be turned into practical exploits.

That distinction matters. Finding a potential bug is only one stage of vulnerability research; demonstrating a reliable path to exploitation can reveal a much more serious security problem.

The 70% figure: Understanding the scale of the risk

The widely reported 70% figure refers to PHP's estimated share of websites using the language, not the percentage of websites confirmed to be exploitable or compromised.

That distinction does not make the vulnerability less serious. It means that a defect in PHP's core infrastructure can have consequences far beyond a single software vendor or application.

~70%

Reported website usage

PHP's reach across the web

PHP is used by a broad range of websites, including content management systems, publishing platforms and web applications. A flaw in its core engine can cross application boundaries.

Wiz Blog 22.6M

Potentially exposed instances

A substantial potential attack surface

Palo Alto Networks identified approximately 22.6 million potentially vulnerable instances in its initial analysis. This is an estimate of exposure, not a count of confirmed compromises.

TechTarget 9.2

Reported CVSS severity

Critical security implications

Wiz reported a maximum severity score of 9.2 out of 10 for the vulnerabilities. Such a rating signals a serious security issue requiring urgent attention.

Wiz Blog

These figures explain why the incident has drawn international attention. But the real-world risk will ultimately depend on how many affected systems remain exposed, how quickly organizations apply fixes, and whether attackers develop reliable ways to exploit unpatched deployments.

The race to patch before attackers catch up

The discovery has triggered a coordinated response involving PHP maintainers, AI researchers, cloud security companies and government cybersecurity agencies.

On October 21, 2026, PHP released fixes for the vulnerabilities. Organizations operating affected systems were urged to identify their PHP versions and apply the appropriate updates. The U.S. Federal Bureau of Investigation and the European Union's cybersecurity agency, ENISA, also urged organizations to take immediate action.

Wiz Blog

The challenge is that releasing a patch does not automatically secure the internet.

Many websites rely on hosting providers, managed services, older application stacks or third-party infrastructure. Administrators must determine which systems are affected, select compatible updates, test changes where necessary and verify that the patched versions are actually running.

Some organizations may also need to investigate whether their systems were compromised before the fix was installed.

Why the period after disclosure is especially dangerous

When a software vulnerability becomes public, defenders are no longer the only people studying it. Attackers can examine the affected code and the patch to understand what changed and develop techniques to target systems that have not yet been updated.

AI could accelerate this process by helping attackers analyze code differences, generate potential exploit strategies and adapt techniques to different software versions or configurations.

This is a central concern surrounding PHP2Shell: capabilities that helped researchers demonstrate a complex vulnerability could also make exploitation more accessible to less-specialized attackers.

However, the distinction between risk and confirmed activity matters. Early reporting described attempted exploitation around the disclosure, while the Associated Press reported that authorities had not received reports of related damage from cyberattacks at the time of its coverage. The extent of any successful exploitation remains a separate question from the vulnerability's technical severity.

Fortune

What website owners and businesses should do now

For organizations using PHP, the immediate priority is to establish exposure and apply the appropriate security fixes.

1. Identify every PHP deployment. Check production servers, development environments, containers, managed hosting accounts and legacy applications.
2. Apply the official security updates. Consult the official PHP website  and the PHP Foundation  for the relevant security announcements and upgrade guidance. Coordinate with hosting providers when they manage the underlying runtime.
3. Verify the update. Confirm that the active runtime—not merely a local development environment—has been upgraded to a fixed version.
4. Investigate suspicious activity. Review relevant server logs, unexpected processes, unusual outbound connections and signs of unauthorized changes. Patching does not remove an attacker who may already have gained access.
5. Reduce exposure while remediation is underway. If a vulnerable system cannot be patched promptly, consult security professionals about temporary isolation or taking the affected service offline. The appropriate response depends on the system and its operational importance.
6. Strengthen recovery measures. Maintain tested backups, restrict administrative access, use multifactor authentication and ensure incident-response procedures are ready.

These measures are consistent with the emergency guidance reported by the Associated Press and the remediation recommendations published by Wiz.

AP News

A turning point for AI and cybersecurity

PHP2Shell illustrates a paradox at the heart of modern AI security: the same advances that help organizations identify dangerous flaws can make those flaws easier for attackers to exploit.

For years, complex vulnerabilities could remain hidden not because the relevant code was inaccessible, but because understanding the interactions required to exploit it was difficult and time-consuming. AI-assisted research changes that equation by allowing specialists to investigate more possibilities, automate portions of the analysis and test sophisticated hypotheses more efficiently.

The defensive opportunity is substantial. AI tools could help maintainers examine mature codebases, uncover previously overlooked defects and develop fixes before criminals discover practical attack methods.

But the process also creates new pressure. Open-source maintainers must investigate more findings, security teams must prioritize vulnerabilities faster, and organizations must become more effective at deploying updates across complex environments.

OpenAI's Patch the Planet initiative and the collaboration with Wiz and PHP maintainers demonstrate one approach: use AI to identify weaknesses, coordinate disclosure with the people responsible for fixing them, and prepare mitigations before the details become public.

OpenAI

That approach will need to become repeatable as AI capabilities improve. Finding vulnerabilities faster is only part of the solution; the industry must also get better at fixing and verifying them at scale.

Conclusion: The next phase of the cybersecurity arms race

The PHP2Shell incident is a warning about the security of shared digital infrastructure. A vulnerability in a foundational technology can put a vast number of systems at potential risk, while AI can change how quickly researchers discover and demonstrate the weaknesses involved.

The estimated 70% reach of PHP underscores the scale of the potential exposure, but it should not be mistaken for a claim that 70% of websites have been compromised.

The immediate priority is practical: identify affected systems, apply the available fixes, investigate possible breaches and verify that remediation is complete.

The longer-term lesson is more consequential. As AI reduces the time and expertise needed to discover and exploit complex software vulnerabilities, the speed at which organizations can defend their systems becomes a critical part of cybersecurity itself.

The race is no longer simply to find the next vulnerability. It is to make sure the fix reaches every vulnerable system before an attacker does.