AI-Discovered PHP Vulnerabilities Expose 70% of Websites as Computer Security Enters Crisis Era
The shift is unmistakable: AI has turned the hunt for software bugs into a numbers game, and the results are reshaping the internet’s foundation. Frontier models have unearthed a cascade of critical flaws in PHP, the language that drives a massive slice of the web, forcing a global scramble to patch and rethink digital safety.
**AI Uncovers a Decade of Hidden Flaws in PHP Core**
Wiz Research deployed frontier AI models to probe the PHP engine, uncovering multiple critical remote-code-execution vulnerabilities that have lain dormant for years. The findings, grouped under two CVEs with severity scores reaching CVSS 9.2, reveal that every PHP version released in the last decade—stretching back to PHP 5.4—is affected. PHP powers 70% of all websites globally, including WordPress, Drupal, and Wikipedia’s MediaWiki, meaning the flaw touches a vast swath of the internet’s infrastructure. The vulnerabilities allow unauthenticated attackers to execute code on affected servers or siphon sensitive process memory, potentially exposing passwords, API keys, and authentication tokens. While the underlying bugs have existed for decades, demonstrating their exploitability once required exceptionally complex chains of steps, at the edge of what human researchers could practically achieve. Frontier AI models substantially lowered that barrier, transforming a longstanding flaw into an immediate exploit. Patches were released on October 21, 2026, following coordinated disclosure, but the episode underscores how quickly AI can redefine the threat landscape for foundational software.
**A Surge of Discoveries Drives the ‘Vulnerability Apocalypse’**
The PHP2Shell revelations are part of a broader, alarming surge in vulnerability discovery. According to the Electronic Frontier Foundation, three percent of all software vulnerabilities ever found in history were uncovered in October 2026 alone. Researchers have identified nearly a quarter of all software security issues ever discovered this year. EFF describes the current period as a “Vulnerability Apocalypse,” driven by AI lowering the cost and difficulty of finding previously unknown flaws, or zero-days. The organization warns that the situation will worsen before it improves, emphasizing that basic digital security hygiene—keeping browsers and applications updated, using tracker-blocking tools, and employing password managers—is now more critical than ever. The rapid influx of discoveries suggests the industry is entering an era where the volume of threats outpaces traditional patching and defense mechanisms.
**Organized Theft Adds a Physical Dimension to AI-Era Risks**
Beyond the digital realm, the vulnerability surge coincides with a wave of physical thefts targeting data center infrastructure. Organized criminal groups have been stealing millions of dollars in data center equipment through sophisticated highway robberies. In June 2026, a trailer carrying approximately $13 million worth of computer server equipment was targeted as it headed east toward Fayetteville, Georgia, home to one of the largest data center developments in the country. These supply-chain disruptions add a physical layer to the AI-era threats facing the tech industry, as the theft of hardware can compromise the very environments meant to secure critical data. The convergence of software flaws and physical thefts presents a compounding risk for data integrity and availability.
**Developers Urgent to Patch and Reevaluate Security Hygiene**
The coordinated response from the PHP team and security researchers like Wiz offers a brief window of relief, but the underlying trend points to a sustained period of heightened risk. Developers and system administrators are urged to apply the October 21 patches immediately to mitigate the PHP2Shell vulnerabilities. The episode serves as a stark reminder that the democratization of exploit discovery through AI necessitates a renewed focus on basic security practices. As the industry grapples with the implications of AI-accelerated vulnerability discovery, the priority remains closing the known gaps while preparing for the unknown threats the technology will inevitably unveil.
AI-Assisted Discovery of PHP2Shell Vulnerabilities Affecting 70% of Websites
Frontier AI models deployed by Wiz Research uncovered a cascade of critical remote-code-execution vulnerabilities in the PHP engine, flaws that had lain dormant for years within the core language powering 70% of all websites globally. The findings, grouped under two CVEs with severity scores reaching CVSS 9.2, reveal that every PHP version released in the last decade—stretching back to PHP 5.4—is affected. These vulnerabilities allow unauthenticated attackers to execute code on affected servers or siphon sensitive process memory, potentially exposing passwords, API keys, and authentication tokens. While the underlying bugs have existed for decades, demonstrating their exploitability once required exceptionally complex chains of steps, at the edge of what human researchers could practically achieve. Frontier AI models substantially lowered that barrier, transforming a longstanding flaw into an immediate exploit. Patches were released on October 21, 2026, following coordinated disclosure, but the episode underscores how quickly AI can redefine the threat landscape for foundational software.
PHP is a backbone of the web: it is the programming language powering WordPress, Joomla, Drupal, Wikipedia’s MediaWiki, and many others. These vulnerabilities include memory disclosure and unauthenticated remote code execution in PHP itself, independent of the application running on top of it, putting every affected website in immediate risk. Nearly every PHP version is affected by at least one of these issues, including releases dating back to PHP 5.4. The vulnerabilities can allow unauthenticated attackers to execute code on affected servers or read sensitive process memory. That memory may contain passwords, authentication tokens, API keys and certificates belonging to other requests or the server itself. Some vulnerabilities become turning points because they challenge fundamental assumptions about security. In 2014, Heartbleed exposed the fragility of shared infrastructure securing the internet. In 2021, Log4Shell revealed how deeply embedded software dependencies could create widespread exposure that organizations struggled to identify. We believe PHP2Shell could mark a similar turning point for the AI era, illustrating how AI can change the practical exploitability of longstanding flaws.
Sources
- Computer Security Is About to Get a Lot Worse, Here’s What You Can Do
- PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | Wiz Blog
- Grand theft AI: Highway thieves are stealing millions in data center gear
Photo: Unnerving duck (CC BY-SA 4.0)
