AI helped uncover the PHP vulnerability that would take down 70% of the Internet
Increasingly highly effective AI instruments are on the middle of a brand new struggle between those that wish to use them to supercharge cyberattacks, and the defenders who’re harnessing the identical instruments to fend them off. Today, the defenders are hoping they received a leg up in figuring out a essential situation that stands to take down 70% of the web if left unaddressed.
While the software program flaws have now been discovered and patches issued, the query stays whether or not sufficient of the web will deploy the patches in time, earlier than hackers begin exploiting the vulnerability to assault web sites and steal very important information.
Most net pages run utilizing an open-source programming language known as PHP. That language is maintained by the PHP Foundation. Today, the inspiration disclosed two “essential” software program vulnerabilities and issued an emergency patch, urging web sites to implement it instantly or take down their web sites till they can. The vulnerabilities are named CVE-2026-109618 and CVE-2026-109619 and collectively known as “php2shell.”
As studies broke in a single day of the vulnerabilities forward of the patch’s official launch, some opportunistic attackers tried to use it. Cloudflare, a world cybersecurity firm that helps safe hundreds of thousands of internet sites, in response to its web site, started seeing “early assaults,” according to its CTO Dane Knecht. While situations of profitable breaches are nonetheless restricted and unfolding, one startup proprietor reported that the PHP bug is “actual unhealthy” and says everybody needs to be “afraid” after hackers allegedly stole their supply code, uncovered cookie information, and leaked authorized paperwork.
Multiple governments have determined to take web sites offline as a security precaution, together with some businesses within the Netherlands and Finland, Reuters reported. The Federal Bureau of Investigation’s (FBI) Cyber Division and the National Security Agency (NSA) both issued statements urging doubtlessly affected organizations to replace their companies, as did the Prime Minister of Japan, the European Union Computer Emergency Response Team (CERT), and several other different nationwide businesses.
“The impression of the PHP vulnerabilities is very large, [and] can expose a lot of web sites to quick assaults if not patched in time,” Gang Wang, Associate Professor of Computer Science on the University of Illinois’ Grainger Engineering, instructed Fortune. The bugs enable unhealthy actors to remotely execute code on flawed, not-yet-patched PHP programs. Attackers can use that as an “entry level into the community internet hosting that machine, and from there doubtlessly perform assaults that trigger vital injury,” Wang’s colleague David Nicol, Director of the Information Trust Institute on the University of Illinois’ Grainger College of Engineering instructed Fortune.
Among probably the most well-known websites that run on PHP is PhrasePress, which powers roughly 40% of all web sites, in response to Reuters. But PHP is ubiquitous throughout the online, having began as a small venture again in 1994 and grown up with the trendy web. For instance, Facebook launched in 2004 as a PHP web site, though in 2020 the corporate launched into a significant effort to update to completely different software program. Other common websites utilizing PHP embody Microsoft.com, Wikipedia.org, Archive.org (now temporarily offline), Theguardian.com, and Baidu.com, according to w3techs. An preliminary evaluation by the cybersecurity agency Palo Alto Networks identified 22.6 million doubtlessly susceptible situations.
OpenAI co-founder and president Greg Brockman stated PHP was his “first programming language,” in a post concerning the vulnerability discovery. OpenAI’s GPT-5.6 Sol mannequin, in addition to different AI instruments, performed a key function find the vulnerabilities.
“Given the severity of those flaws and PHP’s widespread use, we take into account this one of the impactful safety points in current reminiscence,” OpenAI stated in a blog post. “It highlights how AI can uncover safety flaws with internet-scale impression, however the identical capabilities may also assist attackers quickly develop offensive instruments and exploits.”
The backstory: Three events found completely different components of the bug
Multiple safety organizations independently discovered the difficulty across the similar time, in August. All of them used AI to assist discover the vulnerabilities. They then banded collectively in a coordinated effort with the PHP Foundation to develop fixes and coordinate the disclosure of the vulnerabilities and rollout of the patch, OpenAI stated.
Technically, the primary to find a part of the difficulty was the California-based AI red-teaming agency Calif. OpenAI had invited Calif to affix its Patch the Planet initiative, an effort to proactively discover and patch safety vulnerabilities in digital transport systems. Calif determined to analyze PHP as a result of it “stood out as a high-impact goal,” the corporate says. It reached out to Volker Dusch on the PHP Foundation, after which “started working hacking PHP.”
The Calif staff was “not anticipating to seek out something essential” since PHP has been extremely scrutinized by the cybersecurity group for years. In truth, the bug they ultimately discovered had “been current in PHP for 14 years,” OpenAI’s Brockman identified in his submit. “A restricted model of it had been found in 2024 and wasn’t thought-about vital on the time.” But now that AI fashions can run assault sequences autonomously, virtually no vulnerability is simply too tough to use.
“Php2shell reveals how AI may also help uncover buried flaws and switch complicated exploit chains into sensible assaults, growing the potential threat,” TJ Sayers, Senior Director of Threat Intelligence on the Center for Internet Security instructed Fortune.
On Aug.1, Calif discovered the primary situation utilizing GPT-5.6 Sol. It then knowledgeable OpenAI, which appeared into the difficulty by itself and located further components of the bug. This made the invention extra complete, however virtually made clear that the flaw was extra severe than Calif had initially realized, an OpenAI spokesperson instructed Fortune.
Then, OpenAI started chatting with the PHP Foundation concerning the situation. Through these conversations, OpenAI realized that Wiz, a Google-owned cybersecurity firm, was additionally speaking to them concerning the situation.
Researchers at Wiz had independently discovered the vulnerabilities in August. They determined to analyze PHP within the first place as a result of it’s “the spine of the web,” a Wiz spokesperson tells Fortune, acknowledging that the parallel initiative could seem to be a “coincidence,” however the Wiz staff’s constitution is to analyze high-impact digital transport systems, and PHP was high of thoughts. The Wiz staff recognized the primary situation on Aug. 19, utilizing a mixture of Google’s Gemini 4 Argon, OpenAI’s GPT-5.6 Sol, and Wiz Atlas.
“With 70% of the Internet affected, the impression of php2shell can’t be overstated,” Wiz stated in a blog post saying its findings. “It marks an AI inflection level. The susceptible code had been there for greater than a decade–what AI modified was the flexibility to know the weaknesses and switch them right into a working exploit.”
OpenAI then determined to deliver all of the events collectively, main a “coalition of maintainers, researchers, and safety suppliers to handle [the] essential vulnerabilities,” the corporate stated. That included Wiz, Calif, PHP, Cloudflare, and a number of U.S. authorities businesses, amongst others. Cloudlfare’s weblog submit additionally names the French cybersecurity firm Quarkslab as a part of the hassle.
