Increasingly powerful AI tools are at the center of a new war between those who want to use them to supercharge cyberattacks, and the defenders who are harnessing the same tools to fend them off. Today, the defenders are hoping they got a leg up in identifying a critical issue that stands to take down 70% of the internet if left unaddressed.
While the software flaws have now been found and patches issued, the question remains whether enough of the internet will deploy the patches in time, before hackers start exploiting the vulnerability to attack websites and steal vital data.
Most web pages run using an open-source programming language called PHP. That language is maintained by the PHP Foundation. Today, the foundation disclosed two “critical” software vulnerabilities and issued an emergency patch, urging websites to implement it immediately or take down their websites until they are able to. The vulnerabilities are named CVE-2026-109618 and CVE-2026-109619 and collectively called “php2shell.”
As reports broke overnight of the vulnerabilities ahead of the patch’s official release, some opportunistic attackers tried to exploit it. Cloudflare, a global cybersecurity company that helps secure millions of websites, according to its website, began seeing “early attacks,” according to its CTO Dane Knecht. While instances of successful breaches are still limited and unfolding, one startup owner reported that the PHP bug is “real bad” and says everyone should be “afraid” after hackers allegedly stole their source code, exposed cookie data, and leaked legal documents.
Multiple governments have decided to take websites offline as a safety precaution, including some agencies in the Netherlands and Finland, Reuters reported. The Federal Bureau of Investigation’s (FBI) Cyber Division and the National Security Agency (NSA) both issued statements urging potentially affected organizations to update their services, as did the Prime Minister of Japan, the European Union Computer Emergency Response Team (CERT), and several other national agencies.
“The impact of the PHP vulnerabilities is massive, [and] can expose a large number of websites to immediate attacks if not patched in time,” Gang Wang, Associate Professor of Computer Science at the University of Illinois’ Grainger Engineering, told Fortune. The bugs allow bad actors to remotely execute code on flawed, not-yet-patched PHP systems. Attackers can use that as an “entry point into the network hosting that machine, and from there potentially carry out attacks that cause significant damage,” Wang’s colleague David Nicol, Director of the Information Trust Institute at the University of Illinois’ Grainger College of Engineering told Fortune.
Among the most well-known sites that run on PHP is WordPress, which powers roughly 40% of all websites, according to Reuters. But PHP is ubiquitous across the web, having started as a small project back in 1994 and grown up with the modern internet. For example, Facebook launched in 2004 as a PHP website, although in 2020 the company embarked on a major effort to update to different software. Other popular sites using PHP include Microsoft.com, Wikipedia.org, Archive.org (now temporarily offline), Theguardian.com, and Baidu.com, according to w3techs. An initial analysis by the cybersecurity firm Palo Alto Networks identified 22.6 million potentially vulnerable instances.
OpenAI co-founder and president Greg Brockman said PHP was his “first programming language,” in a post about the vulnerability discovery. OpenAI’s GPT-5.6 Sol model, as well as other AI tools, played a key role in finding the vulnerabilities.
“Given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory,” OpenAI said in a blog post. “It highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits.”
The backstory: Three parties discovered different elements of the bug
Multiple security organizations independently found the issue around the same time, in August. All of them used AI to help find the vulnerabilities. They then banded together in a coordinated effort with the PHP Foundation to develop fixes and coordinate the disclosure of the vulnerabilities and rollout of the patch, OpenAI said.
Technically, the first to discover part of the issue was the California-based AI red-teaming firm Calif. OpenAI had invited Calif to join its Patch the Planet initiative, an effort to proactively find and patch security vulnerabilities in digital infrastructure. Calif decided to investigate PHP because it “stood out as a high-impact target,” the company says. It reached out to Volker Dusch at the PHP Foundation, and then “got to work hacking PHP.”
The Calif team was “not expecting to find anything critical” since PHP has been highly scrutinized by the cybersecurity community for years. In fact, the bug they eventually found had “been present in PHP for 14 years,” OpenAI’s Brockman pointed out in his post. “A limited version of it had been discovered in 2024 and wasn’t considered significant at the time.” But now that AI models can run attack sequences autonomously, almost no vulnerability is too difficult to exploit.
“Php2shell shows how AI can help uncover buried flaws and turn complex exploit chains into practical attacks, increasing the potential risk,” TJ Sayers, Senior Director of Threat Intelligence at the Center for Internet Security told Fortune.
On Aug.1, Calif found the first issue using GPT-5.6 Sol. It then informed OpenAI, which looked into the issue on its own and found additional elements of the bug. This made the discovery more comprehensive, but almost made clear that the flaw was more serious than Calif had originally realized, an OpenAI spokesperson told Fortune.
Then, OpenAI began chatting with the PHP Foundation about the issue. Through those conversations, OpenAI learned that Wiz, a Google-owned cybersecurity company, was also talking to them about the issue.
Researchers at Wiz had independently found the vulnerabilities in August. They decided to investigate PHP in the first place because it’s “the backbone of the internet,” a Wiz spokesperson tells Fortune, acknowledging that the parallel initiative may seem like a “coincidence,” but the Wiz team’s charter is to investigate high-impact digital infrastructure, and PHP was top of mind. The Wiz team identified the first issue on Aug. 19, using a combination of Google’s Gemini 4 Argon, OpenAI’s GPT-5.6 Sol, and Wiz Atlas.
“With 70% of the Internet affected, the impact of php2shell cannot be overstated,” Wiz said in a blog post announcing its findings. “It marks an AI inflection point. The vulnerable code had been there for more than a decade–what AI changed was the ability to understand the weaknesses and turn them into a working exploit.”
OpenAI then decided to bring all the parties together, leading a “coalition of maintainers, researchers, and security providers to address [the] critical vulnerabilities,” the company said. That included Wiz, Calif, PHP, Cloudflare, and multiple U.S. government agencies, among others. Cloudlfare’s blog post also names the French cybersecurity company Quarkslab as part of the effort.