AI Discovers Critical 'PHP2Shell' Flaw Threatening 70 % of the World's Websites
AI tools from OpenAI and Google Wiz uncovered a pair of critical vulnerabilities in PHP that could allow remote code execution on millions of sites, prompting emergency patches and government warnings worldwide.
On 21 October 2026, AI-powered security tools developed by OpenAI and Google Wiz identified two critical zero-day vulnerabilities in PHP, the server-side scripting language that underpins more than 70 % of all websites. Dubbed 'PHP2Shell' and assigned CVE-2026-109618 and CVE-2026-109619, the flaws allow attackers to remotely execute malicious code on any unpatched PHP server, potentially giving them full control over websites and the data they hold. The PHP Foundation released emergency patches ahead of schedule after the AI systems flagged the bugs; however, the window for exploitation remains wide. Cybersecurity agencies from Australia, the United States, the United Kingdom, the European Union, and Japan issued urgent advisories telling web administrators to apply patches immediately or take affected servers offline. The discovery has renewed debate about AI's dual role in cybersecurity: the same models capable of finding bugs can also help malicious actors exploit them faster than traditional defences respond.
