The vulnerability resides in the core PHP system, the engine and runtime libraries that power dynamic websites. Unlike a mistake in individual site code, the flaw is deep in the language itself, making every unpatched PHP-based system vulnerable. Exploit code, dubbed PHP2Shell, gives attackers direct command-line control of the server, bypassing the website interface.
The flaw was discovered in August 2026 by a researcher at Calif, a security research firm, using an OpenAI AI model. The researcher alerted the nonprofit that manages PHP as part of a coordinated disclosure process. However, the vulnerability became public before patches were ready. According to Amazon Web Services officials, hackers began "broadly" attempting to exploit the flaw.
The discovery highlights the double-edged nature of AI in cybersecurity. The model identified a subtle memory management bug in the PHP codebase that had existed for over a decade, a bug human auditors might have missed for years. The same AI capabilities could be used by attackers to scan for vulnerable targets and automate exploitation.
Individual internet users are not directly at risk and do not need to patch personal computers. However, organizations running PHP-based systems, including government agencies, universities, hospitals, and businesses, are urged to check server administration panels or contact their web hosts to ensure PHP is updated to the latest patched version. Sites built on content management systems such as WordPress are also advised to verify their hosting provider has applied the fix.
The PHP2Shell episode underscores a new reality for cybersecurity: as AI tools become standard for both defenders and attackers, rapid patching remains the most essential defense.