The two security bugs in PHP, a programming language used by many of the web pages that make up a significant portion of the internet, prompt an international dash to secure websites and online services. The crisis has grown even more alarming, since AI tools enabled researchers to discover vulnerabilities that had been unknown for years, while security experts are concerned that hackers can exploit vulnerable systems even quicker, with similar AI capabilities.
The vulnerabilities, named PHP2Shell, allow criminals to carry out unauthorized actions on the vulnerable machines without any login. The vulnerabilities were exposed on Oct. 21, 2026, which resulted in emergency patches from websites and temporary restrictions on access to some services, as they worked to secure their systems.
With AI, the Old weakness of software became an immediate risk
Many websites use PHP behind the scenes to manipulate information, communicate with databases, and create dynamic presentations. It works well with a variety of platforms and content management systems such as WordPress, which is why it’s not just a WordPress problem, or even a problem with one business.
Both vulnerabilities are associated with PHP memory management problems. In some instances, attackers might be able to exploit the vulnerabilities and run their own code on a vulnerable server without authentication. This can lead to revealing private information or the hacker being able to access parts of the server.
The key takeaway from this incident is the involvement of AI in detecting and testing the weaknesses. The researchers used sophisticated AI models, combined with other security technologies, to explore the complex vulnerabilities and show how they can be used.
AI has reportedly reduced the time it took to complete a task, which might have taken months, to just a few days. Cybersecurity researchers say AI has made a task that would have taken months to complete much faster – in days. The finding is a testament to the growing impact AI is having on cybersecurity research, enabling experts to tackle complex software issues more effectively.
Websites Go Dark as Security Teams Race to Close the Gaps
The disclosure has already wrought some chaos outside the cybersecurity labs. Reuters reports that the European and Japanese governments and companies temporarily halted some Internet services in the wake of the attack and implemented security measures. The financial institutions, airlines, railways, and government departments were affected.
This is due to PHP’s ubiquity. A vulnerability in a technology used on a large portion of the internet can cause a problem to be difficult: Organizations have to find out which all systems are vulnerable, and ensure that they have applied the correct patch, and that the services provided are safe to resume.
Satellite agencies are advising organisations to patch PHP now. The UK National Cyber Security Centre has also recommended that businesses find out if there are systems running PHP, and to prioritise those exposed to the internet and upgrade to fixed versions.
Security updates were issued by the PHP Foundation on October 21. It also noted that early indications of one underlying problem had been found back in 2024, but the problem was not addressed at that time due to a lack of clarity on how to exploit it. The delay has been blamed by the foundation on a structural failure.
The Same AI Breakthrough Could Help Hackers
The most significant thing to learn from the PHP security problem is that it’s not just a PHP problem.
When dealing with complex code, AI can assist security researchers in analyzing the code and determining if there are flaws that could be threats. This could enable defenders to identify and fix issues that could take years to become apparent.
Those powers, however, might also make it easier for bad guys to wreak havoc. Previously, tasks such as finding vulnerable systems and developing the ways to exploit them are more likely to be more easily automated.
That will make for a challenging race. Security teams must be proactive and discover vulnerabilities and fix them before criminals are able to exploit them. However, a vulnerability that has been made public can also be studied to determine feasible fixes and what to aim for on systems that haven’t been patched yet.
Recurrent crises have brought about a desire for a more proactive approach by governments. On 23 October, Japan announced the creation of a team of researchers to create artificial intelligence models to simulate attacks and find vulnerabilities in technology systems before criminals can take advantage of them.
What Website Owners and Everyday Users Should Watch
If you’re a website owner, developer, or business, then the first thing you need to do, which is easy, is to ensure that your PHP installations are correct, install any necessary security patches, and check for any suspicious activity. Organizations should follow official security advice and restrict access to or take a vulnerable system offline if it is not possible to secure it in time.
The average person who uses the Internet can’t fix flaws in the servers of their favorite Web sites. If personal details are released, however, using unique passwords and enabling passkeys or multi-factor authentication if available and monitoring financial accounts can mitigate some of the risks.
Don’t assume that all of the sites that use PHP are compromised. A vulnerable installation is not an indication that the installation has been compromised.
The bigger warning is more difficult to ignore: AI is also enabling the identification of critical software vulnerabilities in a timely manner, and the pursuit to remediate these vulnerabilities is just as significant as the pursuit of the vulnerabilities. Now the challenge is whether organizations can be quick enough to ensure the security of widely used internet services.
