PHP2Shell Security Flaws Trigger Global Cybersecurity Emergency

A major cybersecurity alert has triggered a global response after researchers uncovered two critical vulnerabilities in PHP, a programming language used by approximately 70% of websites worldwide. The vulnerabilities, collectively known as PHP2Shell, could allow attackers to execute malicious code remotely on affected servers without requiring a legitimate account or password. Discovered with assistance from artificial intelligence tools, the flaws remained hidden in PHP’s underlying code for years. The disclosure on October 21, 2026, prompted government agencies, technology companies and website operators to urgently assess their systems. According to Reuters, organisations in several European countries temporarily took websites offline as a precaution while developers prepared and deployed security updates. The incident demonstrates how a vulnerability in widely used foundational software can create security risks across an enormous part of the internet.

The vulnerabilities are particularly concerning because PHP supports many popular website platforms and services, including WordPress, Drupal and Joomla. Researchers at cybersecurity company Wiz reported that the flaws could enable unauthorised access to server memory, potentially exposing sensitive information such as passwords, authentication tokens and API keys. In more serious scenarios, attackers could exploit the weaknesses to execute commands on affected servers, steal information or alter website content. Wiz said its researchers demonstrated remote code execution against several widely used content-management systems, although the underlying problems were in PHP itself rather than those applications. This means that simply updating a website’s plugins or application code may not be sufficient. Organisations must ensure that the PHP software running their systems has received the appropriate security patches.

Artificial intelligence played a significant role in identifying and demonstrating the vulnerabilities. Security researchers used advanced AI models and automated research tools to investigate complex weaknesses in PHP’s memory management and develop ways to reproduce them. Wiz reported using its Wiz Atlas research tool alongside Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol. Separately, cybersecurity company Calif also reported discovering PHP vulnerabilities with the assistance of a large language model. The findings were coordinated with PHP developers and other security organisations before public disclosure. Researchers explained that the flaws were unusually difficult to exploit through traditional manual methods because successful attacks required multiple technical steps and careful analysis of how software handled memory. AI reduced some of these barriers, making it possible to identify and validate weaknesses that had remained undetected for years.

The public disclosure has created an urgent race between defenders applying patches and attackers searching for vulnerable systems. Reuters reported that approximately 1.5 million of 2.6 million internet hosts examined by Censys were running PHP versions for which a fix was not available at the time of the report. Security agencies warned that attackers could use the newly published technical information to develop or adapt exploits against unpatched servers. Several organisations, including government departments and major online services, temporarily restricted access to systems while applying updates. The United States National Security Agency and other authorities also issued warnings urging organisations to patch affected installations or take vulnerable websites offline when immediate updates were not possible. Security experts cautioned that the speed at which AI can help analyse software weaknesses could shorten the time available for organisations to respond to future vulnerabilities.

The incident also highlights growing concerns about the dual-use nature of artificial intelligence in cybersecurity. The same technologies that help researchers discover vulnerabilities and protect software can potentially help malicious actors identify weaknesses and develop attacks more quickly. OpenAI has separately reported that it notified more than 100 organisations about incidents involving unauthorised activity associated with its AI agents, although those incidents are distinct from the PHP2Shell vulnerabilities. Together, these developments have increased scrutiny of how AI companies test their systems, restrict access to sensitive tools and respond when models behave in unexpected ways. Security specialists argue that responsible disclosure, independent testing, coordinated patching and effective monitoring will become increasingly important as AI-assisted vulnerability research becomes more accessible.

Website owners and organisations using PHP are being urged to identify affected installations and apply the official security updates appropriate to their versions. Businesses relying on managed hosting services should contact their providers to confirm that the underlying PHP runtime has been patched. Organisations should also review security logs for suspicious activity, check for unauthorised changes and rotate credentials if there is evidence that sensitive information may have been exposed. Additional protections, such as web application firewalls, can provide another layer of defence, but they do not replace installing the required software updates. The PHP2Shell incident is a reminder that the security of the internet depends on maintaining widely shared software components, not merely protecting individual applications. As AI continues to accelerate vulnerability discovery, organisations will need faster patching processes and stronger security practices to keep pace with emerging threats.