AI Reveals Critical PHP Vulnerabilities Affecting 70% of Websites
AI-assisted research uncovered critical PHP bugs risking remote server control.
Why it matters: Millions of websites running PHP face serious cybersecurity risks, affecting compliance and risk management for legal and IT teams. Prompt patching is essential to avoid data breaches and legal liabilities.
- Two critical vulnerabilities found in PHP, affecting an estimated 70% of all websites worldwide.
- Flaws date back to PHP version 5, released in 2004, exposing sites for nearly two decades.
- PHP Foundation released emergency patches on October 21, 2026, to mitigate risks.
- NSA and FBI issued warnings urging immediate patching or site shutdowns to prevent cyberattacks.
Researchers using OpenAI's GPT-5.6 Sol AI model have identified two critical security vulnerabilities in PHP, a programming language that powers about 70% of websites globally. These vulnerabilities allow attackers to execute commands remotely on web servers without the need for login credentials, a technique known as remote code execution.
Known as 'PHP2Shell,' these flaws have existed since PHP version 5, introduced in 2004, meaning many websites have operated with these hidden security gaps for nearly 20 years. Independent security firms Calif and Wiz corroborated these findings through AI-driven code analysis, confirming the severity of the issue.
In response, the PHP Foundation issued emergency patches on October 21, 2026. Website operators are strongly advised to apply these updates promptly to prevent exploitation.
The U.S. National Security Agency (NSA alert) warned that unpatched servers are at high risk of compromise and could lead to unauthorized data access or full server takeover. Similarly, the FBI's cyber division (FBI Cyber Division) emphasized the urgency of patching or taking affected websites offline to mitigate threats.
Remote code execution vulnerabilities enable attackers to run arbitrary code on servers, potentially allowing them to manipulate data, disrupt services, or install malware. This technical explanation is crucial for legal and compliance professionals to understand the severity of the risk when managing web infrastructure.
The discovery showcases the growing role of AI in cybersecurity, as OpenAI highlighted that the vulnerabilities were identified before any reported malicious attacks. This early detection underscores AI's emerging utility in proactively securing digital systems.
The coordinated effort, dubbed 'Patch the Planet,' involved OpenAI collaborating with the PHP Foundation and global security communities to swiftly address the vulnerabilities and minimize risk exposure.
For legal and IT teams, this incident underscores the importance of vigilant vulnerability management and the integration of AI tools to detect hidden threats. It also highlights the potential legal implications of cybersecurity lapses on large-scale web infrastructure.
By the numbers:
- 70% — Percentage of websites running PHP potentially affected.
- 2004 — Release year of PHP version 5, when the vulnerabilities originated.
- October 21, 2026 — Date when emergency patches were issued.
Yes, but: While AI accelerated discovery and early patching, widespread adoption of fixes may take time, leaving some sites vulnerable.
What's next: Monitoring for exploit attempts will continue, with further updates expected as security teams analyze new variants.