{"slug": "a-just-revealed-security-flaw-is-hitting-computer-systems-around-the-world", "title": "A just-revealed security flaw is hitting computer systems around the world", "summary": "Security researchers at Calif discovered two PHP memory-management flaws, dubbed PHP2Shell, that potentially affect 70% of the world's computer systems and are rated 9.2 out of 10 on the CVSS v4.0 severity scale, according to a Wall Street Journal report published Wednesday. A patch has been released, and the NSA issued guidance on X while European Union cybersecurity experts urged organizations unable to patch to take affected websites offline, with numerous European government sites going dark Wednesday. Calif chief executive Thai Duong warned that attackers could use AI to weaponize the patch code: \"Some dude on Twitter could take the patches and run AI against it and post some exploit script. All hell will break loose.", "body_md": "- A coding flaw in a widely used web programming language is causing a global scramble to secure websites and servers.\n- While the issue was uncovered decades ago, security experts at the time believed it was too complex to be exploited.\n- Researchers recently discovered the flaw could be exploited easily using AI-driven tools.\n\nSecurity experts using AI-powered analysis tools just revealed a pair of serious coding flaws that potentially impact 70% of the world’s computer systems, making them vulnerable to hackers who could use their own AI programs to exploit the weaknesses on a massive scale.\n\nFirst reported by the [Wall Street Journal](https://www.wsj.com/tech/cybersecurity/ai-just-found-a-bug-that-puts-up-to-70-of-the-worlds-websites-at-risk-fd0902ea) on Wednesday, the revelation has systems managers across the globe scrambling to install a just-released patch that experts say should thwart attempts by nefarious actors to gain control of websites and systems, most of which use the so-called PHP technology to power digital tools.\n\n[Reuters](https://www.reuters.com/technology/what-is-php-why-did-it-take-government-websites-offline-2026-10-21/) reports web operators around the world were taking measures to secure their systems, including numerous government websites across Europe that went dark Wednesday, to execute fixes. European Union cybersecurity experts are warning organizations unable to apply the code patches to take affected websites offline.\n\n### How the U.S. responded\n\nThe National Security Agency issued similar direction Wednesday in a post on X on and said it would follow up with more specific guidance.\n\nThe White House said federal agencies were working with leading AI labs to speed up a fix to the security flaws, according to a report from the [BBC](https://www.bbc.com/news/articles/cmly0lg3w5x2o).\n\nThe issue, now being identified as the PHP2Shell, represents a class of problems in the way the PHP programming language manages a computer’s memory, according to the Journal report. The flaw can be exploited in numerous ways with some strategies requiring just a few seconds to execute by hackers who could use it to run unauthorized software on any unpatched web server.\n\nAs is typical when any digital vulnerability is made public, IT experts are now engaged in a race against hackers who have the opportunity to assess the patch code for new workarounds while also seeking out systems that have yet to install the security fix. And they’re likely to employ AI-driven tools to expedite the intrusion efforts.\n\n“Some dude on Twitter could take the patches and run AI against it and post some exploit script,” Thai Duong, the chief executive of Calif, the security company that first discovered the issue, told the Wall Street Journal. “All hell will break loose.”\n\n### What is PHP?\n\nPHP is a free, open-source programming language that works behind the scenes to run websites, according to [Reuters](https://www.reuters.com/technology/what-is-php-why-did-it-take-government-websites-offline-2026-10-21/). When a user loads a website, the server running PHP assembles the content and sends the finished page to the user’s web browser.\n\nAccording to web technology tracker W3Techs, per Reuters, PHP powers nearly three-quarters of the world’s websites and is the software behind pages hosted by WordPress, which includes 40% of all websites, which includes blogs, small business pages, government portals, online shops and news outlets.\n\nThe PHP2Shell flaws are rated 9.2 out of 10 on the CVSS v4.0 severity scale, an industry standard for assessing security issues. A single flaw in PHP opens the same door on millions of servers at once and whoever exploits the flaw controls the website, according to the Reuters report.\n\n### When was the problem discovered?\n\nThe flaws in the PHP code had been present for years, according to the Wall Street Journal, and had been flagged as in issue decades ago. But security experts at the time believed it was too difficult to exploit and the problem was deprioritized.\n\nRyan Austin, a digital security researcher at Calif, uncovered the PHP problems with assistance from OpenAI’s GPT-5.6 Sol platform, one of the AI developer’s most advanced models, during an audit conducted in August. A working group was formed to address the security flaw with efforts in place to keep the exploit concealed in an attempt to keep hackers at bay until a solution was found. The work led to the new patch, originally scheduled to be released on Oct. 22 but news of the work leaked Tuesday.\n\nVolker Dusch, a security engineer with the nonprofit foundation that manages the PHP project, led the team tasked with assembling a security fix. Dusch’s team, according to the Journal report, decided to rush out the patch. On Tuesday, they warned the world to stand by and expect a critical security update on Wednesday.\n\nIt was “a good balance to inform defenders,” Dusch said, “and not give attackers too much time to develop exploits.”", "url": "https://wpnews.pro/news/a-just-revealed-security-flaw-is-hitting-computer-systems-around-the-world", "canonical_source": "https://www.deseret.com/business/2026/10/21/website-computer-server-security-flaw-artificial-intelligence-hackers-cybersecurity-php-programming-language/", "published_at": "2026-10-21 17:57:07+00:00", "updated_at": "2026-10-21 18:41:57.554071+00:00", "lang": "en", "topics": ["ai-safety", "artificial-intelligence"], "entities": ["PHP", "Calif", "Thai Duong", "National Security Agency", "Wall Street Journal", "Reuters", "W3Techs", "WordPress"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/a-just-revealed-security-flaw-is-hitting-computer-systems-around-the-world", "markdown": "https://wpnews.pro/news/a-just-revealed-security-flaw-is-hitting-computer-systems-around-the-world.md", "text": "https://wpnews.pro/news/a-just-revealed-security-flaw-is-hitting-computer-systems-around-the-world.txt", "jsonld": "https://wpnews.pro/news/a-just-revealed-security-flaw-is-hitting-computer-systems-around-the-world.jsonld"}}