PHP Armageddon: OpenAI & Wiz Uncover Ancient Critical Bugs

The 60-second version

1. Security firm Calif and OpenAI, then Google-owned Wiz, independently used frontier AI models to find two critical PHP flaws that had sat unnoticed for roughly two decades.
2. The bugs  collectively “php2shell”  let an attacker run commands on a web server with no login, potentially opening a path into the wider network behind it.
3. PHP powers around 70% of all websites, so the blast radius is enormous. The PHP Foundation shipped an emergency patch on October 21, 2026.
4. The U.S. NSA, the FBI, and several European governments urged site owners to patch at once, or take sites offline until they can.

Incident Snapshot

What Actually Happened

On October 21, the PHP Foundation, the small nonprofit that maintains the language  pushed an emergency security release and told anyone running a website to apply it without delay. Within hours, the U.S. National Security Agency issued a rare public advisory, and governments across Europe began pulling their own sites offline as a precaution. The trigger was php2shell: a pair of critical vulnerabilities that had been hiding in PHP’s code for the better part of two decades.

What made this disclosure different from the usual critical-bug Wednesday was not the severity alone, but who found it. The flaws were surfaced by artificial intelligence, frontier models run by OpenAI and by Google’s Wiz, digging through code that thousands of human eyes had passed over since the mid-2000s.

What php2shell Actually Is

Strip away the branding and php2shell is two bugs that work as a chain. Both involve reaching parts of a server’s memory that a program should never be allowed to touch, then abusing that access to execute code. Stitched together, they let an attacker send a crafted request to a vulnerable site and run commands on the machine behind it with no login, no stolen credentials, and no legitimate account required.

That is close to the worst category of web flaw there is. Researchers warn the real danger is lateral: a single compromised web server can become a foothold, an entry point into the broader network that hosts it. Because the weakness lives in PHP itself rather than in any one application, it is not limited to WordPress, Laravel, or any particular stack, WordPress has said as much, noting the fix belongs at the server and host level, not in the CMS.

How AI Dug Out a Twenty-Year-Old Bug

This is the part the industry is actually rattled by. In early August, Calif, a California red-teaming firm working under OpenAI’s “Patch the Planet” initiative found the first flaw using OpenAI’s GPT-5.6 Sol model. OpenAI then investigated further and uncovered additional pieces of the bug. Weeks later, and entirely independently, Wiz identified the same issue using a combination of Google’s Gemini 4 Argon, GPT-5.6 Sol, and its own Wiz Atlas security agent. Quarkslab and Cloudflare joined the coordinated effort to validate the findings and test fixes.

The significance is in why this bug survived so long. A limited version of it reportedly surfaced in 2024 but was dismissed as impractical to exploit proving it was weaponizable required chaining steps that sat at the outer edge of what human researchers could realistically pull off. AI collapsed that barrier. As Wiz put it, “With AI this is no longer a barrier.” OpenAI, for its part, called php2shell one of the most impactful security issues in recent memory.

Who Found What, and How

How Bad Is It, Really?

The scary number is 70%, PHP’s share of the web, according to W3Techs. But share of sites is not the same as count of exposed servers, and the more grounded figure comes from Palo Alto Networks, which flagged roughly 22.6 million potentially vulnerable instances. That is still a vast attack surface, and the asymmetry is the problem: defenders have to patch tens of millions of servers, while an attacker needs only the ones that stay unpatched.

There is a sharper edge for older sites. The fix landed in PHP 8.5.12, but PHP 8.1 and everything before it are already end-of-life and will not receive a backported patch. Sites stuck on those versions, and there are many cannot simply update; they have to jump major versions, which can break code and is exactly the kind of work that gets postponed. Those laggards are where the long tail of risk will live.

The Global Scramble

The government response was unusually fast and unusually public. In the United States, the NSA issued a rare advisory telling organizations to update immediately or take affected sites offline until they could, and the FBI’s cyber division echoed the call. Across Europe, the reaction was physical: Germany’s digital ministry, France’s interior ministry, and agencies in Belgium, the Netherlands, Finland, and the Czech Republic pulled official websites down pre-emptively while patches were applied. In Japan, Prime Minister Sanae Takaichi posted a public warning, and the EU’s CERT urged the same. The PHP Foundation called the flaws among the most severe it had ever handled.

Is It Being Exploited?

Here the signals conflict, and honesty matters more than a clean headline. OpenAI’s position is that researchers reached the bug before criminals did and that there were no confirmed cases of exploitation in the wild at the moment of disclosure. But as the news broke, Cloudflare’s chief technology officer reported early attack activity, and at least one startup owner claimed hackers had stolen source code and leaked internal documents. Those incidents are limited and still unfolding, but with the vulnerability now public and a known patch to reverse-engineer, the window between disclosure and mass scanning is measured in hours, not weeks.

What Site Owners Should Do Now

1. Update PHP to 8.5.12 (or the latest patched release on your branch) immediately on every server, not just production.
2. If you are on PHP 8.1 or older, treat this as an upgrade project, not a patch: there is no fix for end-of-life versions. Plan the jump now and shield the site in the meantime.
3. If you cannot patch right away, follow the NSA’s guidance and take the site offline until you can. A dark site beats a breached one.
4. If you are on managed or shared hosting, confirm in writing that your host has patched. The fix lives at the server level, your CMS version will not save you.
5. Check logs for unusual requests and outbound connections from web servers, and rotate any secrets (keys, tokens, DB credentials) that a compromised server could have exposed.

The Bigger Picture

php2shell is being read less as a single bad bug and more as a marker. The same AI capability that let defenders excavate a decades-old flaw before it was abused will, inevitably, let attackers do the reverse, adapt and weaponize exploits across versions and configurations at machine speed. The PHP Foundation said the quiet part plainly: tools now surface bugs faster than ever, “for defenders and attackers alike.” php2shell was patched in time. The open question is how many of the next ones will be.

Ethan Mitchell

Writer · TechJox

Ethan Mitchell is a technology writer at TechJox, specializing in artificial intelligence, cybersecurity, SaaS platforms, software applications, and digital automation. His writing covers AI tools, data privacy, emerging technologies, and software reviews, with a focus on practical insights, clear explanations, and helping readers make informed technology decisions.