Two dangerous vulnerabilities in software that powers much of the internet have triggered an international security alert. The discovery also reveals how artificial intelligence is changing the battle against cyberattacks.
A major cybersecurity alert has sent website administrators, technology companies, and government agencies scrambling to protect their systems after researchers, assisted by artificial intelligence, uncovered two critical vulnerabilities in PHP, one of the most widely used programming languages on the internet. The flaws, collectively known as PHP2Shell, could allow attackers to gain unauthorized control of vulnerable web servers, potentially stealing sensitive information, modifying websites, installing malicious software, or disrupting online services.
The scale of the threat is enormous. PHP is used by approximately 70 percent of websites worldwide, including sites built with popular content management systems such as WordPress, Drupal, and Joomla. However, using PHP does not automatically mean a website has been compromised.
How Artificial Intelligence Helped Discover the Threat
The discovery marks a significant development in cybersecurity. Researchers working with advanced AI systems were able to identify weaknesses in PHP and demonstrate how they could be exploited. OpenAI reported that its models helped researchers uncover the vulnerabilities through an initiative called Patch the Planet. Cybersecurity company Wiz independently identified the flaws using AI-assisted research.
Unlike traditional software testing, which can require extensive manual investigation, advanced AI systems can analyze complex code, explore possible attack scenarios, and help researchers identify combinations of weaknesses that might otherwise remain unnoticed. But the discovery also raises an uncomfortable question: If AI can help security experts uncover dangerous vulnerabilities, what prevents cybercriminals from using similar tools?
A Race Against Hackers
On October 21, PHP developers released emergency security updates addressing the two vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. The urgency was justified. Amazon’s threat intelligence team reported detecting an attempted exploitation on October 17, four days before the public release of the patches. Subsequent reports described broader efforts to target vulnerable servers.
Government agencies and cybersecurity organizations urged administrators to install the fixes immediately. Some public websites and online services were temporarily taken offline while their operators worked to secure their systems. The incident also exposed a longstanding problem in the technology industry: essential internet infrastructure often depends on open-source software maintained by relatively small teams with limited resources. According to the PHP Foundation, elements of the underlying security problem had been recognized as early as 2024, but practical fixes were delayed.
What Website Owners Should Do
For businesses, publishers, schools, and individuals operating websites, the immediate priority is ensuring that their hosting provider has installed the appropriate PHP security updates. The patched releases include PHP 8.3.36, 8.4.27, and 8.5.12, as well as 8.2.35 for that older branch. Administrators should verify the exact installed version rather than assuming that an installation is safe simply because it uses PHP 8.3 or 8.4.
WordPress users should also keep their themes and plugins updated, maintain reliable backups, and consult their hosting providers about server-level security. Importantly, updating WordPress itself does not necessarily update the PHP software running on the server. Those are separate components, and both require attention.
AI: A New Weapon for Both Sides
Perhaps the most consequential lesson from the PHP security crisis extends beyond the vulnerabilities themselves. Artificial intelligence is dramatically accelerating the discovery of software weaknesses. Security teams can now investigate complex systems faster, identify dangerous flaws earlier, and coordinate defenses before widespread damage occurs.
Yet attackers may benefit from the same technological advances, using AI to analyze security patches, develop malicious code, and identify vulnerable targets. The result could be a new cybersecurity arms race in which the speed of discovery, response, and protection becomes increasingly important. For the millions of people who depend on websites every day, the PHP incident offers a reminder that the internet’s reliability depends on software most users never see—and on the people and increasingly intelligent tools working to keep it secure.
