FOR IMMEDIATE RELEASE
Security researchers used artificial intelligence to find and help patch a decade-old vulnerability in the programming language that underlies roughly 70% of the internet, even as attackers began exploiting it within hours of disclosure.
SAN FRANCISCO, Calif., October 22, 2026 — The PHP Foundation disclosed two critical software vulnerabilities on October 20, 2026, and issued an emergency patch after security researchers using artificial intelligence tools identified flaws capable of affecting an estimated 70% of websites worldwide, according to the foundation and multiple cybersecurity firms involved in the discovery. The vulnerabilities, designated CVE-2026-109618 and CVE-2026-109619 and collectively named "php2shell," prompted the foundation to urge affected websites to apply the patch immediately or take their sites offline until they could do so.
PHP, an open-source programming language maintained by the PHP Foundation, powers a large share of the modern web, including WordPress, which according to Reuters runs approximately 40% of all websites. Other major sites built on PHP include Microsoft.com, Wikipedia.org, Archive.org, TheGuardian.com and Baidu.com, according to data from W3Techs. Facebook also launched as a PHP site in 2004, though the company moved to different software beginning in 2020. An initial scan by cybersecurity firm Palo Alto Networks identified 22.6 million potentially vulnerable instances of the software.
The flaws allow attackers to remotely execute code on unpatched PHP systems, according to Gang Wang, associate professor of computer science at the University of Illinois's Grainger College of Engineering, who told Fortune that the impact of the vulnerabilities "is massive" and "can expose a large number of websites to immediate attacks if not patched in time." David Nicol, director of the Grainger College's Information Trust Institute, told Fortune that such code execution can serve as "an entry point into the network hosting that machine, and from there potentially carry out attacks that cause significant damage."
Attackers moved quickly once word of the vulnerabilities began circulating late on October 20, ahead of the official patch release. Cloudflare, a global cybersecurity company that protects millions of websites, recorded "tens of thousands" of exploit attempts within 45 minutes of the disclosure becoming public, according to co-founder and CEO Matthew Prince. That figure rose to "hundreds of thousands" within two hours and reached millions by the evening of October 21, Prince said. Amazon Web Services reported on October 21 that the vulnerability was "now being broadly exploited in the wild," and said it had detected exploit attempts in the days before the official October 20 disclosure, raising the possibility that information about the flaw had reached hackers early. One startup owner said the PHP bug is "real bad" and that everyone should be "afraid," after reporting that hackers had stolen the company's source code, exposed cookie data and leaked legal documents.
Governments responded with a mix of precautionary shutdowns and formal warnings. Some government agencies in the Netherlands and Finland took websites offline as a safety measure, Reuters reported. The FBI's cyber division and the National Security Agency both issued statements urging potentially affected organizations to apply the patch, as did the prime minister of Japan, the European Union's computer emergency response team and several other national cybersecurity agencies.
The discovery of the vulnerabilities traces back to August 2026, when multiple security organizations independently identified elements of the flaw using AI tools, according to OpenAI. The first party to find part of the issue was Calif, a California-based AI red-teaming firm that had been invited to participate in OpenAI's Patch the Planet initiative, an effort aimed at proactively identifying and fixing vulnerabilities in digital infrastructure. Calif said it chose to examine PHP because the language "stood out as a high-impact target," and after contacting Volker Dusch at the PHP Foundation, the firm began testing the software. According to OpenAI cofounder and president Greg Brockman, Calif's researchers were "not expecting to find anything critical" given how heavily PHP has been scrutinized by security professionals over the years. Brockman noted that the underlying bug had "been present in PHP for 14 years" and that a limited version of it had surfaced in 2024 without being deemed significant at the time.
Calif identified the first element of the flaw on August 1 using OpenAI's GPT-5.6 Sol model and reported it to OpenAI, which conducted its own investigation and uncovered additional components of the bug, according to an OpenAI spokesperson who spoke with Fortune. That follow-up work revealed the flaw was more serious than initially understood. OpenAI then began discussions with the PHP Foundation and learned that Wiz, a cybersecurity company owned by Google, was separately in contact with the foundation about the same issue.
Wiz researchers said they had independently discovered the vulnerabilities in August, explaining to Fortune that they investigated PHP because it is "the backbone of the internet." A Wiz spokesperson acknowledged that the parallel discovery might appear to be a "coincidence" but said the company's research team is charged with examining high-impact digital infrastructure, making PHP a natural focus. Wiz identified the first issue on August 19 using a combination of Google's Gemini 4 Argon, OpenAI's GPT-5.6 Sol and its own Wiz Atlas tool. In a blog post, Wiz stated that "with 70% of the internet affected, the impact of php2shell cannot be overstated," calling the episode "an AI inflection point" because the vulnerable code had existed for more than a decade while AI tools enabled researchers to understand and exploit the weakness.
OpenAI subsequently organized a coordinated response, bringing together what it described as a coalition of maintainers, researchers and security providers to address the vulnerabilities. Participants included Wiz, Calif, the PHP Foundation, Cloudflare and multiple U.S. government agencies. Cloudflare's own blog post on the matter also credited the French cybersecurity firm Quarkslab as part of the collaborative effort.
In a blog post, OpenAI stated that "given the severity of these flaws and PHP's widespread use, we consider this one of the most impactful security issues in recent memory," adding that the episode "highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits." TJ Sayers, senior director of threat intelligence at the Center for Internet Security, echoed that assessment, telling Fortune that "php2shell shows how AI can help uncover buried flaws and turn complex exploit chains into practical attacks, increasing the potential risk."
The communications office of this organization continues to monitor developments in cybersecurity and artificial intelligence and will issue further statements as warranted by news in the field.
Source: Fortune
