Technology 4 min read By Bethany Hadley
OpenAI model helped uncover PHP flaw affecting most websites
A vulnerability in the core PHP programming language, which powers an estimated 70 per cent of websites, prompted urgent warnings from governments and security agencies after a researcher used an OpenAI model to find it.
Governments and organisations around the world began scrambling on 21 October 2026 to fix a vulnerability in PHP, the programming language that powers a large share of the modern web. The flaw could give hackers access to data and control of websites, and it prompted urgent warnings from the US National Security Agency, cybersecurity agencies and software vendors.
A researcher at a security research firm found the flaw in August 2026 using an advanced artificial intelligence model from OpenAI. The firm alerted the nonprofit that manages PHP. However, word of the flaw leaked before the PHP organisation released patches, and according to officials at Amazon Web Services, hackers began to attempt to exploit it broadly.
Estimates suggest that around 70 per cent of websites run on PHP, so the implications reach far beyond a single company or platform. PHP is used to deliver dynamic content, visual elements and searchable features. When a visitor enters a web address or clicks a link, PHP scripts run on the web server, take that input and produce the output the browser displays.
The current security issue sits in the core PHP system, the engine and runtime libraries that underpin the language, rather than in the code of any individual website. That makes every unpatched system running PHP potentially vulnerable. Because websites are reachable by anyone on the internet, attackers can locate PHP-based sites using automated tools and run an exploit program. The exploit, called PHP2Shell, gives the attacker shell access, a term for direct command-line control of the computer hosting the website. That bypasses the website interface and opens a route to all of its data.
The way the flaw came to light is itself significant. It was found through coordinated disclosure, in which researchers report a flaw to developers before making it public. The discovery illustrates how AI can now examine vast codebases and spot unusual patterns in hours or days, work that once required teams of specialists reviewing code by hand. The PHP weakness had existed in the core code for more than a decade before the research identified it.
The same capability cuts both ways. The reasoning tools that help defenders find flaws first can also allow attackers to scan the web quickly for vulnerable targets and automate the creation of exploits. Security specialists argue that this is why security teams need to use AI to find vulnerabilities, report them responsibly and help produce patches.
For most internet users the direct risk is limited, because PHP runs on remote web servers and no action is needed on a personal computer. Organisations are a different matter. Many government agencies, universities, hospitals and businesses rely on PHP-based systems, and those that delay patching could expose sensitive data, face disruption to their operations or give attackers a foothold into wider networks.
Anyone who manages a website, blog or server should check the server administration panel or web host immediately to confirm that PHP has been updated to the latest patched version. This applies even to small sites built on popular content management systems such as WordPress. Where a third party hosts the site, the owner should ask the host whether the vulnerabilities have been patched.
The episode points to a broader reality for cybersecurity. Keeping web infrastructure secure is a continuous race, and as AI tools become standard for both defenders and attackers, fast patching remains the most essential defence.
6
