Decade-old PHP bug puts websites at risk: How AI uncovered it, who is vulnerable and how to stay safe | Explained

Two critical vulnerabilities in PHP, the programming language behind around 70% of websites worldwide, have prompted urgent warnings from cybersecurity agencies. Dubbed PHP2Shell, the flaws could allow attackers to remotely run malicious code, steal sensitive data, and take control of affected servers without authentication.

Wiz Research found the flaws and announced them on 21 October 2026, alongside PHP security updates. Google, OpenAI, Amazon Web Services (AWS) and other tech firms worked with the researchers to analyse the vulnerabilities and develop safeguards.