AI Uncovers Decades-old Flaw Reaching Most of the Web

WHO:

ABC News - OpenAI said it led a coalition of researchers, security providers, and others working to address PHP vulnerabilities over two months.

ABC News - Britain’s prime minister’s office said government experts were working with OpenAI and international partners on the issue.

ABC News - James Sullivan, director of cyber and tech at the Royal United Services Institute in London, said attackers could gain unauthenticated access to affected sites.

ABC News - Japanese Prime Minister Sanae Takaichi urged website administrators to check for PHP and install the patch; Chief Cabinet Secretary Minoru Kihara said Japan had received no reports of related cyberattack damage.

ABC News - The European Union cybersecurity agency, ENISA, advised organizations to take immediate action.

Techmeme - Anthropic said Claude identified 493 security issues across 25 open-source projects.

Fox News - The FBI joined the NSA in warning organizations to address the PHP vulnerabilities.

CNN - Research teams at OpenAI, Google-owned cybersecurity company Wiz, and cybersecurity company Calif discovered and addressed the vulnerabilities.

CNN - Wiz researchers used Google’s Gemini 4 Argon, Wiz Atlas, and OpenAI’s GPT-5.6 Sol during the research.

CNN - The PHP Foundation, which supports the PHP programming language, released a patch and urged website operators to update their systems immediately.

CNN - Cloudflare worked with the PHP Foundation, Calif, OpenAI, and Wiz to address the issue.

CNN - The National Security Agency urged organizations using PHP to update their systems or take them offline if they could not update.

TechCrunch - OpenAI and Google’s Wiz found the vulnerabilities; the article describes AI as both a means of discovering and preventing the issue and a source of heightened risk.

WHAT:

ABC News - The FBI’s cyber division warned that PHP vulnerabilities could let attackers remotely execute code, steal or alter data, or use a compromised system to launch other attacks.

ABC News - Governments and corporations worked through the night on urgent security updates; outages or limited services continued while security work was underway.

ABC News - OpenAI said it had led a coalition working to address PHP vulnerabilities over two months.

ABC News - OpenAI called the flaws “one of the most impactful security issues in recent memory” and said AI appeared to find them before attackers did.

ABC News - James Sullivan said there were multiple patches for different software types, and some organizations might still be waiting to receive and test them.

ABC News - Finland’s government website said disruption had been resolved, but some content was still missing and being restored.

ABC News - Japan’s Osaka prefecture website said its machine-translation service was unavailable due to a system failure.

ABC News - Sanae Takaichi advised website administrators to check for PHP and immediately install a patch released late Wednesday; she said temporarily suspending websites could reduce risk if patches could not be applied promptly.

ABC News - Minoru Kihara said Japan had received no reports of cyberattack damage related to the vulnerability; parts of some government websites were temporarily taken offline “Just to be safe.”

ABC News - The European Union cybersecurity agency, ENISA, advised organizations to “take immediate action” to address the vulnerabilities.

ABC News - James Sullivan said protective steps include identifying potentially compromised systems, installing updates and patches promptly, and using two-factor authentication.

ABC News - OpenAI called the flaws “one of the most impactful security issues in recent memory” and said AI appeared to find them before attackers did.

ABC News - James Sullivan called taking websites offline while fixing the issue “good practice” and appropriate cyber risk management, while describing the age of some flaws as “staggering.”

ABC News - Minoru Kihara said parts of some Japanese government websites were temporarily taken offline “Just to be safe.”

ABC News - Britain said some limited government services might temporarily be offline during security work, while no large public-facing critical services were affected.

ABC News - Finland’s government website reported that disruption had been resolved, though some content was still being restored; Osaka prefecture’s website said its machine-translation service was unavailable.

ABC News - Sullivan described two flaw mechanisms: one corrupts system memory, while the other leaves user data stored on the system, potentially enabling access, downloading, or deletion.

ABC News - Sullivan said multiple patches were available for different software types, and organizations might need time to receive and test them.

Fox News - The FBI said the PHP flaws involve two critical vulnerabilities.

Techmeme - The projects covered more than 5 million lines of C, C++, Java, PHP, and Python code; one issue had gone unnoticed for 21 years.

Fox News - The vulnerabilities could provide a path to a server’s file system or database.

Fox News - The FBI advised organizations to inventory where PHP is running, prioritize internet-facing systems and products that include PHP, and monitor web servers for suspicious activity.

Fox News - Possible signs of exploitation include PHP processes unexpectedly launching command shells or downloading files.

Fox News - PHP is used to assemble webpage content for visitors and powers platforms including WordPress.

Techmeme - Anthropic reported that Claude flagged 493 security issues across 25 open-source projects covering more than 5 million lines of C, C++, Java, PHP, and Python code; one issue had gone unnoticed for 21 years.

CNN - The vulnerabilities, collectively called PHP2Shell, could affect 70% of the internet.

CNN - The bugs could allow attackers to remotely execute code, read memory potentially containing passwords, disrupt services, and expose customer data.

CNN - European government websites went offline as companies updated their systems, according to Reuters.

CNN - Wiz researchers compared the issue’s significance to Heartbleed, a 2014 bug affecting an encryption technology estimated to be used by two-thirds of the web.

CNN - Wiz researchers said the flaw could be a turning point in cybersecurity.

TechCrunch - The article characterizes the vulnerabilities as “ancient holes” and the situation as causing panic across the internet.

WHERE:

CNN - The vulnerabilities affect PHP systems and potentially websites across the internet; some government websites in Europe went offline during updates.

CNN - The article identifies Calif as a California-based cybersecurity company.

WHEN:

CNN - The bugs were discovered in late August and publicly disclosed after PHP had a fix.

WHY:

ABC News - James Sullivan said the flaws were more than a decade old, highlighting the long period they had remained undiscovered.

CNN - Researchers said the flaws had existed for decades, but proving they could be exploited required an exceptionally complex sequence of steps that had been beyond what human researchers could practically achieve.

CNN - AI reduced the difficulty of demonstrating exploitability, making a longstanding flaw practical to exploit.

TechCrunch - The issue was high risk because AI could help uncover vulnerabilities while also increasing cyber risk.

HOW:

ABC News - Sullivan recommended identifying potentially compromised systems, promptly installing software updates and patches, and using two-factor authentication.

Fox News - The FBI recommended organizations inventory PHP installations, prioritize internet-facing systems and products that include PHP, and monitor web servers for suspicious activity.

Fox News - Possible signs of exploitation include PHP processes unexpectedly launching command shells or downloading files.

Fox News - The NSA said it would provide more specific guidance on the vulnerabilities.

Fox News - The FBI recommended taking affected systems offline until they are protected if an update cannot be made immediately.

CNN - Researchers said the vulnerabilities could let attackers disrupt services and expose customer data.

CNN - AI enabled researchers to conduct security research across multiple applications in hours. Wiz researchers wrote: “With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work.”

CNN - Wiz researchers said: “The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve,” and that frontier AI models “substantially reduced that barrier, turning a longstanding flaw into an exploit.”

(UPDATED October 22, 2026 18:05 UTC)

A pair of critical vulnerabilities in PHP, software used by websites around the world, could let attackers run code remotely, access files and databases, or steal and alter data. The flaws, dubbed PHP2Shell, may affect a large share of the internet, and one had gone unnoticed for more than two decades. Researchers from OpenAI, Google-owned cybersecurity firm Wiz, and Calif helped uncover and address the problems, with OpenAI saying a coalition worked on them for two months. The PHP Foundation released patches, and the FBI and NSA urged organizations to update systems, prioritize internet-facing services, and monitor for suspicious activity. The European Union’s cybersecurity agency also called for immediate action. Governments and businesses carried out urgent security work, with some services disrupted or temporarily taken offline. Japan reported no related attack damage, while officials advised administrators to patch promptly or suspend vulnerable sites until they could.

(UPDATED October 22, 2026 16:13 UTC)

Researchers have uncovered two critical vulnerabilities in PHP, the software used by many websites, including WordPress, and the flaws could put a large share of the internet at risk. Called PHP2Shell, they could let attackers run code remotely, reach servers’ files or databases, expose customer information, and disrupt services. OpenAI said it led a coalition addressing the vulnerabilities, which researchers found with help from AI tools; the flaws had existed for decades, and one had gone unnoticed for more than 20 years. The PHP Foundation released patches, while the FBI, NSA, European Union cybersecurity agency, and governments urged organizations to act quickly. Administrators should identify PHP systems, prioritize internet-facing services, install and test updates, and watch for suspicious activity. The FBI advised taking systems offline if they cannot be updated promptly. Some government websites and services were temporarily disrupted during security work.

(UPDATED October 22, 2026 15:02 UTC)

Researchers have uncovered two critical vulnerabilities in PHP, software that powers websites including WordPress, with potential exposure across much of the internet. The flaws, known as PHP2Shell, could let attackers run code remotely, reach files or databases, access sensitive data, or disrupt services. Researchers at OpenAI, Google-owned cybersecurity firm Wiz, and Calif found and addressed the bugs, which had existed for decades. They said AI made it practical to demonstrate how the complex flaws could be exploited. The PHP Foundation released a patch and urged website operators to update immediately. The FBI and NSA advised organizations to identify PHP installations, prioritize internet-facing systems, and watch for suspicious activity. The FBI also recommended taking vulnerable systems offline if they cannot be patched. European agencies urged immediate action, while some government websites experienced disruptions during security updates.

(UPDATED October 22, 2026 12:01 UTC)

Researchers have uncovered two critical vulnerabilities in PHP, the software used by WordPress and many websites to assemble pages. Dubbed PHP2Shell, the flaws could let attackers run code remotely, access files or databases, expose customer data, and disrupt services; they may affect a large share of the internet. Research teams at OpenAI, Google-owned cybersecurity firm Wiz, and Calif found and addressed the bugs, with help from Cloudflare and the PHP Foundation, which released a patch and urged operators to update immediately. The FBI and NSA warned organizations to act. The FBI recommends identifying PHP installations, prioritizing internet-facing systems, and watching for PHP processes launching command shells or downloading files. If systems cannot be patched, the NSA says to take them offline. Researchers said AI made complex exploits practical. Separately, Anthropic says Claude flagged 493 issues across 25 open-source projects, including one flaw missed for 21 years.

(UPDATED October 22, 2026 05:03 UTC)

Security researchers have uncovered serious PHP vulnerabilities that could expose websites, customer data, and server systems across the internet. Known collectively as PHP2Shell, the flaws may allow attackers to run code remotely, access memory containing passwords, and disrupt services; researchers said they could affect 70 percent of the internet. OpenAI, Google-owned cybersecurity firm Wiz, and Calif helped identify and address the bugs, with AI tools enabling researchers to demonstrate risks that had been difficult to prove. The flaws had existed for decades, and one related issue went unnoticed for 21 years. The PHP Foundation has released a patch and urged operators to update immediately. The FBI and NSA advise organizations to inventory PHP systems, prioritize internet-facing services, and monitor for suspicious activity. If systems cannot be updated, the agencies recommend taking them offline until protected. Some European government websites went offline during updates.

(UPDATED October 21, 2026 22:18 UTC)

The FBI and National Security Agency are urging organizations to secure vulnerable PHP systems after researchers uncovered flaws that could expose servers to attack. Known as PHP2Shell, the vulnerabilities may let attackers run code remotely, access files or databases, disrupt services, and expose customer data. PHP powers websites and platforms such as WordPress, and the flaws could affect a large share of the internet. The PHP Foundation released a patch and urged operators to update immediately; organizations unable to do so should take affected systems offline. The FBI also recommends prioritizing internet-facing systems and watching for suspicious activity, such as PHP processes launching command shells or downloading files. Researchers said AI tools helped demonstrate how decades-old flaws could be exploited, completing complex research in hours. Some European government websites went offline during updates.

(UPDATED October 21, 2026 20:14 UTC)

Researchers at OpenAI, Google-owned cybersecurity company Wiz, and Calif discovered and fixed PHP vulnerabilities known as PHP2Shell, which could affect 70 percent of the internet. The flaws may let attackers remotely run code, access memory containing passwords, disrupt services, and expose customer data. The PHP Foundation released a patch, and the National Security Agency urged organizations to update immediately or take affected systems offline. Cloudflare also worked with the researchers and foundation on the response, while some European government websites went offline during updates. The bugs had existed for decades, but researchers said AI made it practical to demonstrate how to exploit them. Wiz used Google and OpenAI AI tools in its research, completing work in a week that could previously have taken a team months. Separately, Anthropic said Claude flagged 493 security issues across 25 open-source projects, including one that had gone unnoticed for 21 years.

(UPDATED October 21, 2026 19:26 UTC)

Researchers using advanced AI uncovered and helped fix a set of PHP vulnerabilities called PHP2Shell, which could put as much as 70 percent of the internet at risk. The flaws could let attackers run code remotely, read memory that may contain passwords, disrupt services, and expose customer data. OpenAI, Google-owned cybersecurity firm Wiz, and California-based Calif took part in the research, with Cloudflare working alongside them and the PHP Foundation to address the problem. The foundation released a patch and urged website operators to update immediately. The National Security Agency said organizations unable to update should take affected systems offline. Researchers said the flaws had existed for decades, but proving they could be exploited required a complex chain of steps. AI tools sharply lowered that barrier, enabling work across multiple applications in hours. Some European government websites went offline during updates.