SCIENCE · VERIFIED DEVELOPMENT
AI‑Discovered PHP Core Flaw Sparks Global Patching Rush
WHY IT MATTERS
Unpatched PHP sites expose sensitive data and operational control to attackers, making rapid patch deployment essential for protecting national infrastructure and private organizations alike.
What happened
A flaw in the core PHP system, the programming language that powers about 70 % of websites, was uncovered in August 2026 by a security researcher using an OpenAI model. The defect, which has existed in PHP’s code for more than a decade, allows attackers to run arbitrary commands on any unpatched server, giving them full control and access to all site data.
The vulnerability was publicly disclosed before PHP’s patch was released, and Amazon Web Services reports that hackers have begun exploiting it with the PHP2Shell exploit. Governments, universities, hospitals and businesses that rely on PHP‑based sites are scrambling to apply the new patches.
Site owners using popular CMSs such as WordPress must verify that their hosting providers have updated PHP to the latest version to prevent a broad wave of potential breaches.
PRIMARY SOURCES
PHP is in the foundation of 70% of websites – here’s what it is and why a flaw in the software is a major hacking threat
The Conversation US · Doug Jacobson, University Professor of Electrical and Computer Engineering, Iowa State University · CC BY-ND; link/attribution intake only—no edited republication