Artificial intelligence has uncovered security flaws that could let hackers take over the servers behind nearly 70 percent of the world's websites, including most government websites.
Researchers at cybersecurity firms Calif and Wiz independently discovered the flaws in August using advanced AI tools, including OpenAI’s GPT-5.6 Sol and Google’s Gemini 4 Argon. Their findings have sent companies and government agencies scrambling to secure their websites.
The vulnerabilities affect PHP, a programming language that powers roughly 70 percent of the world’s websites, according to Wiz. Researchers not only identified the weaknesses, but used the AI tools to develop working attacks against the vulnerabilities to demonstrate how hackers could exploit them.
🇺🇸 A security bug hiding in the internet for over 10 years has finally been cracked by AI. The flaw, called PHP2Shell, affects PHP, the programming language behind up to 70% of the world's websites, including online shops, government services and major platforms. And it's a nasty one. Hackers could use it to take over vulnerable servers, steal customer data, install malware or knock websites offline. Researchers in California used an advanced OpenAI model to figure out how the bug could be exploited, something that had stumped experts for years. The good news is that fixes are already out. But websites need to install them quickly, and the FBI is urging those that can't to temporarily go offline. For regular users, simply visiting a PHP website doesn't mean they're hacked. The bigger worry is personal information stored on sites that haven't been fixed yet. Source: CBS News / Writer: Daniyal
— Mario Nawfal (@MarioNawfal) October 22, 2026
Collectively dubbed PHP2Shell, the vulnerabilities could allow attackers to run malicious code on affected servers, steal sensitive information, alter website content, plant backdoors for future access, or knock sites offline.
What makes the discovery especially striking is the flaws’ complexity. According to the researchers, they likely would not have found them without AI.
In other words, if researchers using AI hadn’t found the flaws and figured out how to exploit them first, malicious hackers might have, leaving website operators around the world scrambling to catch up while attackers went to work.
That possibility cuts both ways. Much of the fear surrounding AI centers on what bad actors can do with it. Even when people acknowledge its benefits, the potential for abuse often overshadows them. But this case offers a reason to rethink that balance.
The same technology that could help hackers attack websites helped researchers find the weaknesses and get fixes into operators’ hands first. That means that broadly restricting access to powerful AI could come at a major cost. Giving defenders the tools to find and fix vulnerabilities before attackers exploit them is itself a form of protection.
The goal should not be to slow the good guys down while assuming the bad guys will follow the rules, a familiar mistake in the debate over concealed-carry laws.
PHP powers much of the web, and two critical flaws just forced governments to tell sites to patch or go offline. The bugs allow remote code execution without login. AI helped researchers uncover flaws that had gone undetected for years. Japan issued a late-night warning, and some ministries and banks took pages down. No major breaches are confirmed. Meanwhile, an Indian certificate company used keys as weak as the number 4, and GitLab disclosed a perfect 10.0 vulnerability dating back to 2014. The internet keeps proving how fragile it is. Writer: Lucas https://t.co/mLwwcHO9vj
— Mario Nawfal (@MarioNawfal) October 23, 2026
Although researchers discovered the flaws in August, they held off on publicly disclosing them until this week to give developers time to prepare fixes. Those fixes were released on October 21, but website operators are still scrambling to patch their systems.