SAN FRANCISCO, United States — Researchers using artificial intelligence have identified critical security flaws in PHP, a programming language used by an estimated 70 per cent of websites worldwide.
The vulnerabilities, collectively known as PHP2Shell, could allow hackers to gain control of affected web servers, obtain confidential information, and execute malicious computer commands without authorisation.
Emergency software updates were released on Wednesday, October 21, 2026, following an investigation involving OpenAI, Google-owned cybersecurity company Wiz, and security research firm Calif.
The discovery has drawn attention to the increasing ability of artificial intelligence systems to identify and exploit weaknesses that have resisted years of conventional security research.
A Security Weakness With a Long History
The latest findings concern weaknesses in how PHP manages computer memory, particularly when an operation fails before the software has completed its work.
Such failures can leave information in an unsafe condition, potentially allowing a subsequent request to manipulate data or execute unauthorised instructions.
The problems are especially significant because PHP operates behind many websites, processing information submitted by users and supporting online applications.
According to CNN, concerns about related weaknesses in PHP date back more than two decades.
In 2004, security researcher Stefan Esser identified a vulnerability involving the programming language’s handling of memory limits.
A separate problem discovered years later prompted corrective action in 2020. Further concerns emerged during a security examination in 2024, although researchers had not demonstrated a practical method of exploiting the underlying weakness at that time.
The earlier findings did not establish that one identical vulnerability remained uncorrected throughout the entire period. Rather, successive investigations identified related weaknesses in PHP’s handling of interrupted operations.
The PHP Foundation subsequently acknowledged that difficulties in developing a reliable solution, together with limited engineering resources, had delayed efforts to address the problem uncovered in 2024.
How Artificial Intelligence Accelerated the Research
The decisive development came when researchers began applying advanced AI systems to the programming language.
Calif started examining PHP in late July through OpenAI’s Patch the Planet initiative, which supports research into vulnerabilities in widely used software.
Within days, researchers identified a method of exploiting weaknesses associated with memory-management failures.
Further investigation revealed additional attack methods.
Calif researcher Ryan Austin’s findings demonstrated how interrupted operations could create opportunities for attackers to manipulate PHP’s internal processes.
Another research team at Wiz independently identified related vulnerabilities in August.
Using advanced AI models and specialised security tools, Wiz researchers demonstrated attacks against applications running on affected PHP systems.
The work involved technology from OpenAI and Google, including GPT-5.6 Sol and Gemini 4 Argon.
The researchers said AI substantially reduced the time required to investigate complicated interactions within the software.
Tasks that previously demanded extensive manual testing could be undertaken more rapidly, allowing investigators to identify and examine potential attack methods.
Wiz also reported that the vulnerabilities could be exploited against popular website platforms, including WordPress, Drupal, and Joomla.
The weaknesses were located within PHP itself rather than necessarily arising from errors in the individual applications.
Why the Findings Alarmed Security Experts
The implications extend beyond the websites directly examined during the research.
Cybersecurity specialists have warned that artificial intelligence could make previously impractical attacks more accessible to criminals.
Developing a successful attack against complex software weaknesses traditionally required considerable technical expertise and sustained experimentation.
AI systems can assist with repeated testing and adjustments, reducing the amount of manual work involved.
Vyas Sekar, a professor of computer engineering at Carnegie Mellon University, told CNN that the PHP findings could signal further discoveries.
“This may be the first of many. This is a wakeup call,” Sekar said.
The concern is that tools capable of helping security researchers identify vulnerabilities may also help malicious actors investigate and exploit similar weaknesses.
Calif’s researchers said their work did not depend on specially restricted AI models unavailable to ordinary users.
That distinction has become an important consideration for cybersecurity specialists assessing how widely sophisticated attack capabilities could spread.
Emergency Updates Followed the Discovery
The researchers shared their findings with PHP’s maintainers before public disclosure, allowing developers to prepare corrective software updates.
The fixes were designed to address two critical vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619.
The PHP Foundation released updated versions of the programming language, including PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
Website operators were urged to install the relevant security updates promptly.
The disclosure process nevertheless encountered difficulties after information about the vulnerabilities circulated before the planned announcement.
According to cybersecurity infrastructure company Cloudflare, its network recorded thousands of suspected exploitation attempts before the public release.
Such activity indicates attempts to exploit the weaknesses, but does not establish that those attempts successfully compromised websites.
Security experts also warned that systems operating outdated PHP versions could remain exposed unless their administrators installed effective fixes.
For affected organisations, updating the underlying programming language is necessary even when the applications running on it have otherwise received their own software updates.
A Changing Challenge for Internet Security
The findings have raised questions about how software developers and cybersecurity organisations can respond when powerful AI systems accelerate the discovery of vulnerabilities.
Adam Meyers, vice-president of counter adversary at CrowdStrike, told CNN that attackers could take advantage of weaknesses discovered by legitimate researchers, even without identifying those weaknesses independently.
He also cautioned that replacing PHP across existing websites would be a costly and technically demanding undertaking.
The programming language is deeply integrated into many established applications, making an immediate transition to alternative technologies impractical for numerous organisations.
Security specialists have consequently emphasised the importance of keeping software updated, identifying weaknesses early, and improving security throughout the development process.
For the researchers involved in PHP2Shell, the episode demonstrated that artificial intelligence can help expose serious software weaknesses before criminals exploit them.
It also showed that the same technology could shorten the time available for organisations to protect themselves once previously hidden vulnerabilities become known.
