PHP powers 70% of websites – a flaw in the software exposes millions to hackers

Governments and organizations worldwide began scrambling on Oct. 21, 2026, to patch a critical vulnerability in PHP, the programming language powering roughly 70% of websites, which could let hackers gain full control of servers and access sensitive data. The flaw, discovered in August 2026 by a security research firm using an advanced OpenAI AI model, resides in PHP's core system, not individual site code, making all unpatched systems vulnerable. Word leaked before patches were ready, and hackers have since begun broadly exploiting it via a tool called PHP2Shell. The discovery highlights AI's dual role in cybersecurity, enabling both faster flaw detection and automated attacks. While everyday users need no action, website managers should immediately update PHP software, as delayed patching risks data exposure and network compromise.