Researchers using OpenAI technology have identified two critical vulnerabilities in PHP, the server-side programming language that powers a large portion of the web. The flaws could have allowed attackers to take control of web servers or steal sensitive information without having legitimate access. OpenAI described the discovery as "one of the most impactful security issues in recent memory."
What happened and when
The potential for an attack exploiting the PHP flaws became public on a Wednesday, triggering swift action: governments and private organizations temporarily took websites offline to apply security fixes. Dozens of sites in the United States, the United Kingdom and other countries were briefly unavailable while administrators installed updates.
The National Security Agency (NSA) and European cybersecurity authorities issued alerts in response to the incident.
Patch release and recommended actions
Security patches addressing the PHP vulnerabilities were released on October 21, 2026. Cybersecurity firms urged all operators of PHP-based systems to install the updates immediately, warning that exploitation could lead to theft of passwords and other user data or takeover of vulnerable servers.
Nature of the vulnerabilities
The researchers found two critical defects that could have allowed an attacker to gain control of a website’s server without legitimate credentials. Cybersecurity firms labeled the issue "php2shell." Wiz, a cybersecurity company, wrote that these findings rank among the most severe vulnerabilities discovered in PHP and possibly in software history.
According to Wiz, the flaws went undetected for more than a decade because exploiting them required complex technical approaches that AI helped researchers uncover.
What is PHP and why this matters
PHP (Hypertext Preprocessor) is a server-side programming language in use since the 1990s. It is estimated to be used by roughly 70% of websites for which the server-side language is known. PHP is common on a variety of sites, including Wikipedia, WordPress blogs and online stores.
Functionally, HTML determines what a browser displays, while PHP runs on the server to collect data and generate the content sent to the browser.
Consequences and context
The prompt release of patches and temporary takedowns helped mitigate immediate risk, but the incident is part of a broader recent wave of cybersecurity problems affecting developer platforms, educational institutions and companies. Some security professionals have dubbed the series of incidents "Black October" because of their number and severity, though many organizations have so far contained the risks and avoided major real-world harm.
Experts recommend that users secure passwords, use password managers, and remain calm while administrators roll out fixes. The ultimate measure of harm will be whether these cyber incidents cause significant real-world disruption, as previous ransomware or infrastructure-targeting attacks have done.
Summary
OpenAI-assisted researchers discovered two critical PHP vulnerabilities; patches were published on October 21, 2026, and numerous websites were briefly taken offline to install fixes. Authorities and security firms advise immediate updates to prevent potential theft of data or server takeover.
