AI helps uncover a deep PHP flaw affecting 70% of the internet

A massive web vulnerability

On October 21, 2026, global governments and organizations began a scramble to fix a major security flaw in PHP. This programming language is a fundamental building block of the modern internet, used to create dynamic content and searchable features on websites. Because it is so widely adopted, the bug created a significant risk for a large portion of the web.

The vulnerability is particularly dangerous because it resides in the core PHP system rather than in the code of a specific website. This means that any site running an unpatched version of the software is potentially exposed to hackers. Security agencies, including the U.S. National Security Agency, issued urgent warnings about the flaw's ability to grant unauthorized access to data.

According to Fortune, the flaw was discovered by a researcher at a security firm in August 2026. The firm used an advanced artificial intelligence model from OpenAI to identify the issue. While the firm alerted the nonprofit that manages PHP, the news leaked before a patch could be released, leading to a surge in hacking attempts.

How the flaw works

To understand the risk, it helps to know how PHP functions on a web server. It operates in two main parts: the core system, which includes the engine and runtime libraries, and individual scripts that implement specific website features. When a user interacts with a site, these scripts take input—like a button click—and produce the output shown in a web browser.

The current security issue sits deep within the core system and its libraries. When a vulnerability exists at this level, an adversary can run unauthorized commands on the computer hosting the website. This allows them to bypass the standard website interface and gain what cybersecurity experts call 'shell access.'

Shell access is a significant escalation because it gives an attacker direct command-line control over the server. This means they can see all of the website's data and potentially take over the entire system. The specific exploit code for this flaw is known as PHP2Shell, which refers to the attacker's ability to enter commands directly into the server's operating system.

The role of artificial intelligence

The discovery of this flaw highlights the growing power of AI in the field of cybersecurity research. For many years, finding subtle bugs in software required large teams of human specialists to manually review massive amounts of code. Today, AI systems can analyze millions of lines of code in seconds to find unusual patterns that humans might miss over decades of development.

In this specific case, the AI helped researchers identify a memory management bug that had existed in the PHP code for over a decade. By using these models, security firms can perform 'coordinated disclosure,' where they report flaws to developers privately before making them public. This process allows for the creation of security patches before the general public is aware of the risk.

However, this technology is a double-edged sword for internet safety. The same reasoning capabilities that help researchers find flaws can also be used by malicious actors. Attackers can use AI to rapidly scan the internet for vulnerable PHP websites and automate the creation of tools to exploit them. This makes it essential for security teams to use AI proactively to find and fix bugs before they can be weaponized.

Who is affected and what to do

The impact of this vulnerability extends to government agencies, universities, hospitals, and large businesses. Because PHP is so common, many organizations rely on it for their primary web infrastructure. If these entities delay patching their systems, they risk having their operations disrupted or providing a foothold for hackers to enter larger networks.

For the average internet user, there is no immediate need to worry or download a patch. Since PHP runs on remote web servers, you do not need to fix your personal computer to stay safe while browsing. The responsibility for security in this instance lies with the people who manage the websites and servers.

If you manage a website, a blog, or a server, you should check your administration panel immediately. This is especially important for sites built on popular content management systems like WordPress. If you use a third-party hosting service, you should contact them to confirm that they have updated their PHP software to the latest patched version.

The future of web security

The PHP2Shell discovery illustrates a new reality where the race between defenders and attackers is accelerating. As AI tools become standard for both sides, the speed of response becomes the most critical factor in maintaining security. Organizations must move toward faster patching habits to keep up with the automated tools that can now scan the entire web for weaknesses.

AI is also being used to help release the very patches that mitigate these vulnerabilities. By using these models to write and test code, developers can respond to threats more quickly than ever before. This creates a continuous cycle where AI is used to both break and fix the infrastructure of the internet.

Ultimately, the goal for security teams is to stay ahead of the curve. As the web becomes more interconnected, the security of core languages like PHP remains a cornerstone of digital safety. Maintaining a proactive stance on software updates is now the most essential defense for any organization hosting data online.