AI discovers high-severity PHP vulnerabilities php2shell, institutions in multiple countries worldwide rush to patch

What is PHP? Why has it triggered a global cybersecurity crisis?

Audio captions, how did artificial intelligence discover a major security vulnerability threatening the global internet? (English video) Article Information

Author, Liv McMahon

Published 23 October 2026 5:01am Last updated: 46 minutes ago

Reading time: 4 minutes

For more than a decade, the technology supporting a large number of websites on the internet has had serious security vulnerabilities, yet they were never discovered.

These vulnerabilities exist in a programming language called PHP. Since the 2000s, PHP has been widely used around the world to build websites.

Since the vulnerabilities were exposed on Wednesday (21 October), governments and cybersecurity agencies around the world have been urgently taking measures to control the impact, urging website operators to install the newly released emergency patches, or otherwise consider temporarily shutting down their websites.

The cybersecurity company Wiz, which took part in discovering the vulnerabilities, described this as the "most serious" security vulnerability discovered by AI to date.

The technology that helped find the vulnerabilities came from OpenAI. The company said this discovery is "one of the most far-reaching cybersecurity issues in recent years."

What is PHP?

Most people may never have heard of PHP, but they very likely use this technology every day.

Typhoon Champi: 1 dead and 171 injured in Taiwan, most counties and cities suspend work and classes

Magnitude 7 earthquake in Nagqu, Tibet, 16 dead and 54 injured; authorities send Wing Loong drones for disaster reconnaissance

North Korea releases photo of Kim Jong Un: why do rumors of his death always resurface?

Preview of the CPC Fifth Plenary Session: why the intensive "tiger hunting" before the meeting? How will it "govern the Party strictly" in the future?

End of Trending

PHP was developed in the early 1990s to help build dynamic web pages and web applications. Today, it is still widely used, including by Wikipedia, online stores, and WordPress, the content management system used by many websites.

When you browse a website, the PHP program is responsible for retrieving data and converting it into the web page you can read.

PHP is also used to develop various tools that help build web applications or speed up development. Laravel, Symfony and Drupal are all widely used PHP development frameworks or tools.

The cybersecurity company Wiz, which helped discover this week's major PHP vulnerabilities, points out that 70% of websites worldwide use PHP.

PHP is maintained by the non-profit PHP Foundation. The organization is made up of individuals and companies that rely on PHP, and is committed to ensuring that this programming language can "continue to develop over the long term."

What are the vulnerabilities?

Multiple cybersecurity researchers and organizations disclosed this week that PHP has two security vulnerabilities. They warned that these vulnerabilities could cause major impact on websites worldwide.

The cybersecurity companies Wiz and Calif said that these vulnerabilities, collectively known as "php2shell," exist in the PHP programming language itself, and multiple PHP versions released over the past decade or more are affected.

Calif researcher Ryan Austin, who helped discover the vulnerabilities, told the BBC that this is "the most serious security vulnerability I have ever discovered."

In a blog post introducing the research findings, Wiz pointed out that under specific conditions, hackers can use the php2shell vulnerabilities to take control of affected web servers and steal sensitive data. This means that all websites built with affected PHP versions may be at risk.

Gorilla Cyber Security CEO Paul Spain told the BBC that AI may also make it easier and faster for hackers to launch such attacks.

He estimated that these vulnerabilities could affect "millions" of websites.

University of Adelaide cybersecurity researcher Jill Slay said that if hackers or states use these vulnerabilities to launch attacks and steal private data from websites, the consequences would be "catastrophic."

Which websites are affected?

The security alert has disrupted multiple online services around the world, covering gaming platforms, government websites and online forums.

Those affected include the Wikimedia Foundation, the organization behind the online encyclopedia Wikipedia. To guard against risk, the foundation has temporarily shut down multiple systems under its umbrella.

The Finnish government, the City of Edinburgh Council in the UK and the BBC have all had some websites or pages suspend operations, and the Dutch cybersecurity agency has also shut down its website.

Image source, EPA

Image caption, websites of institutions including the University of Geneva suspended operations on Wednesday.

Multiple public bodies in Scotland, including local councils and health departments, have also temporarily shut down their websites.

Some experts warn that websites lacking proper maintenance may face higher risks, especially small organizations with limited cybersecurity resources.

UNSW cybersecurity researcher Salil Kanhere said that as technical details of the vulnerabilities are gradually made public, more people may attempt to exploit them in the coming weeks.

What happened after the vulnerabilities were exposed?

The PHP Foundation released security patches on Wednesday to fix vulnerabilities that had existed in PHP software for years.

The organization said: "All PHP users are strongly advised to update immediately."

Governments and cybersecurity agencies around the world have also issued similar warnings, urging website operators to take measures to ensure platform security.

The US National Security Agency (NSA) requires all organizations using PHP to temporarily shut down the relevant systems if they cannot install the patches immediately. The agency pointed out that these vulnerabilities could allow hackers to "directly break into" system databases.

The agency said: "The severity of these risks is enough to require all departments and agencies of the US government to install the patches immediately."

The UK National Cyber Security Centre (NCSC) also issued similar advice and asked organizations to check their systems for "backdoors installed by attackers."

Relevant cybersecurity agencies in the EU, Singapore and Australia also issued similar alerts.

Japanese Prime Minister Sanae Takaichi called on the public to check whether their public websites use PHP.

Image source, Bloomberg via Getty Images

Image caption, Japanese Prime Minister Sanae Takaichi called on the public to check whether their public websites use PHP.

Sanae Takaichi said in a post on social platform X: "We urgently call on everyone to take action tonight."

She said: "If it is difficult to install the patch in time, measures such as temporarily shutting down the website can be considered; this is also an effective way to reduce risk."

Technology companies are also trying to quickly strengthen system security.

E-commerce giant Amazon said that several days before the PHP vulnerabilities were publicly disclosed, the company had already encountered multiple attack attempts targeting these vulnerabilities, but its websites had continued to operate normally.

Matthew Prince, CEO of network infrastructure company Cloudflare, also said that 10 hours before the vulnerabilities were officially announced, the company's network had recorded "thousands" of attack attempts exploiting the PHP vulnerabilities.

He said in a post on X: "Within 45 minutes of the announcement, the number jumped to tens of thousands; within two hours it rose to hundreds of thousands; now it has reached millions."

Researchers at Calif and Wiz, who discovered the vulnerabilities, used advanced AI tools capable of analyzing code and finding vulnerabilities far faster than humans or older systems.

Kanhere said: "Modern software is extremely complex, and some vulnerabilities may go unnoticed for years."

He said: "Bugs in the code itself are not new; what has changed is our ability to find them."

Details of this discovery leaked online this week, forcing PHP developers to hastily disclose the security vulnerabilities and their enormous scope ahead of schedule.

The ChatGPT developer said it has launched a tool to help check whether PHP platforms are secure.

Ryan Ko of the University of Queensland's cyber research center said: "Many of these vulnerabilities stem from the way software was developed in the past. At the time, developers focused mainly on software functionality and did not fully consider security."

What does this mean for you?

These vulnerabilities involve website backends and web development processes, which ordinary users do not directly encounter, so most people do not need to take any action.

However, small businesses that own websites, including merchants using WordPress to build sites, may want to know how to protect themselves.

Cybersecurity experts urge those who own websites or manage PHP-related systems to update to the latest version to keep their websites secure.

Ethical hacker Ken Munro, who has spent years finding security vulnerabilities in computer systems, said the process of installing security patches is "a bit like updating Windows."

If your website is managed by a web hosting company or web developer, you should contact them to confirm whether the PHP security patches have been installed. These patches must be installed directly on PHP itself; updating WordPress or its plugins alone will not solve the problem.

If you manage your website yourself, Munro said, "you are responsible for ensuring the patches are installed."

The UK National Cyber Security Centre advises that if updates cannot be installed in time or temporary protective measures cannot be taken, consider temporarily shutting down the website.

The US National Security Agency also called on all sectors to "heighten vigilance" in the coming weeks and to pay close attention to update information released by software vendors.

The agency said: "It is crucial to remain vigilant about the relevant systems and install patches promptly."

Kanhere said that although responsibility for protecting website security falls mainly on website operators, ordinary users should also pay attention to security advisories from affected services, such as notifications requiring password changes.

He also warned that the public should beware of phishing scam messages sent by people exploiting the attention caused by this incident.

This article was originally written in English. We used artificial intelligence to assist with translation, and BBC journalists reviewed it before publication. Learn more about how we use artificial intelligence.