{"slug": "websites-are-racing-to-patch-software-powering-up-to-70-of-the-web-as-ai-flaws", "title": "Websites are Racing to Patch Software Powering Up to 70% of the Web as AI Uncovers Critical Flaws", "summary": "Developers released emergency security updates on Wednesday for PHP, the programming language behind as much as 70% of the world's websites, after AI-assisted research uncovered critical flaws collectively called PHP2Shell that could let attackers run unauthorized code without logging in. California researcher Ryan Austin found the vulnerabilities during an August audit using OpenAI's GPT-5.6 Sol, and Wiz independently demonstrated unauthenticated code execution against WordPress, Drupal and Joomla deployments plus memory reads that could expose passwords, authentication tokens and API keys; the two flaws carry severity ratings of 9.2 out of 10. The PHP Foundation called the delay since warning signs surfaced in 2024 a \"structural failure\" in its security decision-making and limited resources, and said AI-assisted research is increasing the volume of reports requiring attention.", "body_md": "# Websites are Racing to Patch Software Powering Up to 70% of the Web as AI Uncovers Critical Flaws\n\n## Developers released emergency security updates on Wednesday and urged users to install them immediately.\n\n[Artificial intelligence](https://www.ibtimes.com/topic/ai) helped researchers uncover critical security flaws in PHP, the programming language that powers as much as 70% of the world's websites, triggering an urgent effort Wednesday to protect servers against potential attacks.\n\nThe vulnerabilities, collectively called PHP2Shell, could let hackers run unauthorized code on affected systems without logging in. [According to The Wall Street Journal](https://www.wsj.com/tech/cybersecurity/ai-just-found-a-bug-that-puts-up-to-70-of-the-worlds-websites-at-risk-fd0902ea?mod=hp_lead_pos1), developers released emergency security updates on Wednesday and urged users to install them immediately.\n\nThe oultet noted that Calif researcher Ryan Austin uncovered the problems during an August audit using OpenAI's GPT-5.6 Sol. The findings prompted a coordinated response involving PHP developers and security researchers.\n\nThe potential reach is substantial, but the 70% figure describes PHP's reported prevalence, rather than a confirmed count of compromised websites. Actual exposure depends on whether a server runs affected software, its configuration and whether administrators have installed the fixes. PHP's advisory identifies installations serving web requests as at risk.\n\nPHP operates behind the scenes on websites built with WordPress, Drupal, Joomla and MediaWiki, the software behind Wikipedia. Because the weaknesses sit inside PHP's core engine, \"A flaw in its core engine can affect websites across this ecosystem, even when their own application code is secure,\" [according to cybersecurity company Wiz](https://www.wiz.io/blog/php2shell-php-rce), which independently investigated the flaws.\n\n\"Every PHP version released in the last decade is affected by at least one of these vulnerabilities, going back to version 5.4. Attackers can exploit them remotely, in some cases fairly easily. Immediate patching is strongly advised,\" Wix said.\n\nWiz said its researchers demonstrated attacks against WordPress, Drupal and Joomla deployments that allowed code execution without authentication. They also demonstrated a separate ability to read sensitive information from server memory, potentially exposing passwords, authentication tokens and API keys.\n\nThe two vulnerabilities received severity ratings of 9.2 out of 10, and they concern failures in how PHP handles memory and internal information when processing requests, particularly when errors interrupt normal operations.\n\nThe PHP Foundation acknowledged that warning signs associated with one vulnerability had surfaced in 2024. At the time, the issue was considered theoretical because researchers had not established concrete ways to exploit it.\n\nThe foundation described the subsequent delay as a \"structural failure\" involving its security decision-making process and limited resources. It also said AI-assisted research was increasing the volume of reports requiring attention.\n\nAI changed the practical difficulty of turning complicated memory problems into working attacks. Wiz said developing reliable exploits required extensive testing and adjustments across different software versions and configurations. AI tools helped researchers perform that work more efficiently, reducing the specialist effort needed to adapt an attack to another target.\n\n© Copyright IBTimes 2026. All rights reserved.", "url": "https://wpnews.pro/news/websites-are-racing-to-patch-software-powering-up-to-70-of-the-web-as-ai-flaws", "canonical_source": "https://www.ibtimes.com/websites-are-racing-patch-software-powering-70-web-ai-uncovers-critical-flaws-3808836", "published_at": "2026-10-21 18:10:41+00:00", "updated_at": "2026-10-21 18:40:39.747412+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-safety", "ai-research", "developer-tools"], "entities": ["PHP", "PHP Foundation", "Wiz", "OpenAI", "GPT-5.6 Sol", "Ryan Austin", "WordPress", "The Wall Street Journal"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/websites-are-racing-to-patch-software-powering-up-to-70-of-the-web-as-ai-flaws", "markdown": "https://wpnews.pro/news/websites-are-racing-to-patch-software-powering-up-to-70-of-the-web-as-ai-flaws.md", "text": "https://wpnews.pro/news/websites-are-racing-to-patch-software-powering-up-to-70-of-the-web-as-ai-flaws.txt", "jsonld": "https://wpnews.pro/news/websites-are-racing-to-patch-software-powering-up-to-70-of-the-web-as-ai-flaws.jsonld"}}