AI found a flaw that could have let hackers into most of the websites you use

Most people have never heard of PHP. But if you’ve read a blog, shopped online or checked a government website this week, there’s a good chance PHP was running behind it.

On Wednesday, October 21, the volunteers who look after PHP released an emergency fix for two serious flaws, nicknamed PHP2Shell. The flaws had gone unnoticed for more than a decade. Researchers using AI found them this summer.

The plumbing of the internet

PHP is the behind-the-scenes code that builds a web page before it reaches your screen. About 7 in 10 websites whose technology can be identified use it, according to tracking firm W3Techs.

That includes WordPress, which runs millions of blogs, small business sites and news outlets. It also includes online stores, school portals, hospital pages and city hall websites.

Think of it like the plumbing in a building. Nobody sees it, but nearly every room depends on it.

Why this could have been a disaster

The flaws let a stranger take over a website’s server from anywhere in the world, with no password needed. From there, they could steal customer names, emails and payment details, plant viruses, or take the site down.

Because the problem was in PHP itself, a website couldn’t protect itself with good security on its own end. A carefully guarded government site was as exposed as a hobby blog. Security firm Wiz ranked the flaws among the worst ever found in PHP, “and arguably in software history.”

And many sites never get updated. One scan found that nearly half of PHP sites that show their version run old releases.

AI got there first

PHP’s own team saw hints of the problem in 2024 but couldn’t prove it was dangerous, and the fix stalled. In August, California security firm Calif used an OpenAI model to prove the flaw was real in a matter of days. Wiz found the same flaws on its own using AI tools from Google and OpenAI.

That head start gave PHP, OpenAI, Cloudflare and others about two months to quietly build a fix before criminals knew what to look for.

Attackers didn’t wait

The plan cracked the day before release, when details leaked online. PHP rushed the fix out a day early.

Even so, someone was already trying. Amazon spotted an attempt to use the flaw on October 17, four days before the fix. Cloudflare saw thousands of attempts in the hours before the announcement and millions by the next day.

So far, no company or government has publicly confirmed being hacked through PHP2Shell. Breaches often take weeks to surface, though. To be safe, governments in the UK, Europe, Australia and Canada took some of their own websites offline while they patched.

What now

If you run a website, update PHP now or ask your web host if they have. Everyone else should use different passwords for different sites and keep an eye on card statements for a while.

OpenAI president Greg Brockman expects this won’t be the last. “We expect to find many more such issues over upcoming months,” he said.