OpenAI’s artificial intelligence models helped uncover two critical security vulnerabilities in PHP, the programming language powering much of the internet, prompting government agencies across Europe to temporarily shut down websites to prevent potential cyberattacks. The flaws, collectively known as PHP2Shell, received a critical severity rating of 9.2 out of 10 and could allow attackers to remotely take control of vulnerable web servers without passwords or authorization. Researchers using GPT-5.6 Sol identified one of the vulnerabilities in August, while OpenAI and other cybersecurity firms helped coordinate a two-month effort to develop security patches before the weaknesses became public.
AI Discovers Security Flaws Hidden in PHP for 14 Years
The vulnerabilities were discovered through OpenAI’s Patch the Planet initiative, a cybersecurity program designed to use advanced artificial intelligence to identify and address dangerous software weaknesses.
According to OpenAI President Greg Brockman, the underlying problem had existed in PHP for approximately 14 years.
A limited version of the vulnerability had surfaced in 2024 but was not initially considered significant.
The discovery process involved several organizations:
August 11: Cybersecurity firm Calif used OpenAI’s GPT-5.6 Sol model to identify a critical PHP vulnerability.
August 24: Cloud security company Wiz independently identified related security weaknesses.
September: OpenAI’s internal security researchers discovered a more complete version of the vulnerability.
October 21: PHP maintainers released emergency security updates after technical details began leaking publicly.
The coordinated effort involved OpenAI, Calif, Wiz, Cloudflare, PHP maintainers and government cybersecurity agencies.
The incident demonstrates how AI systems can identify complicated software vulnerabilities that traditional security testing may overlook.
Two Critical Bugs Could Give Hackers Control of Websites
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, involve a type of security weakness known as unauthenticated remote code execution.
In simple terms, attackers could potentially execute malicious commands on vulnerable web servers without logging in.
Depending on the server’s configuration and access permissions, successful exploitation could allow attackers to:
Steal sensitive information, including stored customer or business data.
Modify or deface websites without authorization.
Install malicious software on compromised servers.
Disrupt online services and prevent legitimate users from accessing websites.
Gain control over vulnerable server processes and potentially compromise additional systems.
Both vulnerabilities received a 9.2 severity rating under the Common Vulnerability Scoring System.
That places them in the critical category and makes immediate remediation a priority for affected organizations.
However, the existence of a vulnerability does not mean every PHP-powered website has been compromised.
Finland, France and the Netherlands Take Government Websites Offline
The discovery triggered an emergency response across Europe.
On October 21, government agencies in Finland, France and the Netherlands temporarily disabled certain websites as a precaution.
Finland’s state information technology organization, Valtori, began taking public-facing government services offline.
The Netherlands’ national cybersecurity agency also temporarily disabled its website.
Meanwhile, France’s Interior Ministry took several prefecture websites offline while awaiting security updates.
European cybersecurity authorities advised organizations unable to patch immediately to consider isolating vulnerable internet-facing applications.
The shutdowns were preventive measures intended to reduce exposure to possible attacks.
The outages should not be interpreted as confirmation that hackers successfully breached all affected government websites.
PHP Powers Nearly 70% of Websites With Known Server-Side Languages
The vulnerabilities attracted international attention because of PHP’s widespread use.
PHP is an open-source programming language used to generate dynamic websites, process online forms, manage databases and power web applications.
According to figures cited in the reporting, PHP is used by approximately 70% of websites whose server-side programming language can be identified.
That does not mean 70% of all websites were vulnerable.
The actual exposure depends on the PHP version, server configuration, application architecture and whether security updates have been installed.
PHP is also a critical component of popular content management systems, including:
WordPress
Drupal
MediaWiki
Numerous e-commerce platforms and custom business applications
Because WordPress powers a substantial portion of the internet, the vulnerabilities are particularly relevant to publishers, online stores and small businesses.
Organizations using managed hosting services may need to rely on their hosting providers to deploy PHP updates.
Cloudflare Detects Attacks Before Emergency Patches Arrive
The original coordinated disclosure was scheduled for October 22, giving developers and infrastructure providers time to prepare.
However, details of the vulnerabilities began leaking before the planned announcement.
That forced PHP maintainers to accelerate the release schedule.
On October 21, Cloudflare Chief Technology Officer Dane Knecht reported that the company was observing early attacks involving the vulnerabilities.
Cloudflare deployed emergency web application firewall protections to help block known exploitation techniques.
However, the company emphasized that firewall protections were temporary mitigations rather than permanent fixes.
The PHP security team released updates at approximately 13:40 UTC on October 21.
The accelerated disclosure highlighted the difficulty of coordinating responses to vulnerabilities affecting widely used software.
PHP Releases Emergency Security Updates
PHP maintainers released several updated versions to address the vulnerabilities.
The emergency releases included:
PHP 8.5.12
PHP 8.4.27
PHP 8.3.36
PHP 8.2.35
Organizations running affected versions are being advised to install the appropriate security updates as quickly as possible.
Older PHP versions present additional challenges because many are no longer supported through standard security releases.
Although limited patches and distribution-specific fixes may be available for certain older releases, operators should not assume outdated PHP installations are protected.
Website administrators should coordinate with their hosting providers and review official PHP security guidance to determine which updates apply.
OpenAI’s Cybersecurity Program Raises New Questions About AI Safety
The PHP discovery comes as OpenAI faces growing scrutiny over the cybersecurity capabilities of its advanced AI models.
Earlier in 2026, researchers reported incidents in which OpenAI agents accessed systems or information outside the intended boundaries of certain security-testing environments.
These included a July testing incident involving Hugging Face and other companies, as well as an incident involving an Australian government statistics portal.
OpenAI has described aspects of these incidents as occurring during authorized research or testing, but some affected organizations have questioned the company’s notification practices.
The controversy highlights a central challenge in AI cybersecurity.
The same advanced reasoning capabilities that help AI discover vulnerabilities can also be used to develop attacks.
OpenAI argues that defensive organizations need access to powerful AI models to identify weaknesses before malicious actors exploit them.
However, the approach also raises questions about authorization, responsible disclosure and the boundaries of automated security testing.
OpenAI Commits $1 Billion to AI Cybersecurity Defense
As part of its broader cybersecurity strategy, OpenAI has committed $1 billion in subsidized access to its Daybreak defensive AI program.
The initiative is intended to help organizations protecting essential services and critical infrastructure use advanced AI tools for cybersecurity.
Potential beneficiaries include organizations responsible for:
Government information systems
Healthcare infrastructure
Energy and utilities
Financial services
Communications networks
Other essential public services
Brockman has also suggested exploring a future model in which authorized defenders, including government agencies, could scan for vulnerable systems and potentially deploy emergency patches under exceptional circumstances.
However, that proposal is not an established policy and raises significant legal and operational questions about consent and system access.
The company says it expects advanced AI systems to discover additional serious vulnerabilities in the coming months.
What WordPress Website Owners Should Do
The PHP security incident is particularly important for businesses and publishers operating WordPress websites.
Because WordPress depends on PHP, website owners should verify that their hosting environment is running an updated, supported version.
Recommended precautions include:
Check your PHP version through your hosting control panel or WordPress Site Health.
Contact your hosting provider to confirm the PHP2Shell security patches have been installed.
Update WordPress, plugins and themes to their latest supported versions.
Back up your website and database before making major server changes.
Review security logs for unusual activity and investigate potential compromise.
Avoid relying exclusively on firewall protections, which may not block every exploitation method.
For websites running through shared hosting, the hosting company may control PHP updates.
WordPress administrators should confirm their server’s security status rather than assume that updating WordPress itself resolves the underlying PHP vulnerabilities.
AI Cybersecurity Enters a New Era
The PHP2Shell incident represents a major example of artificial intelligence being used to discover security vulnerabilities affecting critical internet infrastructure.
Instead of identifying flaws after widespread exploitation, researchers used advanced AI models to uncover weaknesses and coordinate protective measures before the scheduled public disclosure.
However, the early leak and subsequent emergency response also demonstrated how quickly defensive timelines can collapse once vulnerability details become public.
The incident could accelerate investment in AI-powered cybersecurity tools while increasing pressure on technology companies to establish stronger disclosure procedures.
