Developers released emergency security updates on Wednesday and urged users to install them immediately. #
Artificial intelligence helped researchers uncover critical security flaws in PHP, the programming language that powers as much as 70% of the world's websites, triggering an urgent effort Wednesday to protect servers against potential attacks.
The vulnerabilities, collectively called PHP2Shell, could let hackers run unauthorized code on affected systems without logging in. According to The Wall Street Journal, developers released emergency security updates on Wednesday and urged users to install them immediately.
The oultet noted that Calif researcher Ryan Austin uncovered the problems during an August audit using OpenAI's GPT-5.6 Sol. The findings prompted a coordinated response involving PHP developers and security researchers.
The potential reach is substantial, but the 70% figure describes PHP's reported prevalence, rather than a confirmed count of compromised websites. Actual exposure depends on whether a server runs affected software, its configuration and whether administrators have installed the fixes. PHP's advisory identifies installations serving web requests as at risk.
PHP operates behind the scenes on websites built with WordPress, Drupal, Joomla and MediaWiki, the software behind Wikipedia. Because the weaknesses sit inside PHP's core engine, "A flaw in its core engine can affect websites across this ecosystem, even when their own application code is secure," according to cybersecurity company Wiz, which independently investigated the flaws.
"Every PHP version released in the last decade is affected by at least one of these vulnerabilities, going back to version 5.4. Attackers can exploit them remotely, in some cases fairly easily. Immediate patching is strongly advised," Wix said.
Wiz said its researchers demonstrated attacks against WordPress, Drupal and Joomla deployments that allowed code execution without authentication. They also demonstrated a separate ability to read sensitive information from server memory, potentially exposing passwords, authentication tokens and API keys.
The two vulnerabilities received severity ratings of 9.2 out of 10, and they concern failures in how PHP handles memory and internal information when processing requests, particularly when errors interrupt normal operations.
The PHP Foundation acknowledged that warning signs associated with one vulnerability had surfaced in 2024. At the time, the issue was considered theoretical because researchers had not established concrete ways to exploit it.
The foundation described the subsequent delay as a "structural failure" involving its security decision-making process and limited resources. It also said AI-assisted research was increasing the volume of reports requiring attention.
AI changed the practical difficulty of turning complicated memory problems into working attacks. Wiz said developing reliable exploits required extensive testing and adjustments across different software versions and configurations. AI tools helped researchers perform that work more efficiently, reducing the specialist effort needed to adapt an attack to another target.
© Copyright IBTimes 2026. All rights reserved.