PHP discloses a critical memory-management vulnerability, dubbed "PHP2Shell", that affects up to 70% of websites, discovered using GPT-5.6 Sol in August (Robert McMillan/Wall Street Journal)

PHP has disclosed a critical memory-management vulnerability known as "PHP2Shell" that affects up to 70% of websites. According to the Wall Street Journal, the flaw was discovered in August using GPT-5.6 Sol, part of a trend where AI tools are helping identify severe online bugs. Cyber experts are working to patch the vulnerability before hackers can use AI to exploit it.

Wiz Research reported that the vulnerabilities include memory disclosure and unauthenticated remote code execution within the PHP core itself, independent of any applications running on it. These flaws impact every PHP version released in the last decade, dating back to version 5.4. Successful exploitation could allow attackers to deface websites, steal sensitive data, or take control of affected servers.

While the underlying flaws had existed for decades, Hacker News notes that demonstrating their exploitability required a complex chain of steps that was at the edge of human capability. Frontier AI models helped reduce this barrier. On October 21, 2026, PHP released a patch to fix multiple memory-safety vulnerabilities in the core engine.

Brief written by urgent.news from Techmeme, Hacker News — 2 reports on this story. Machine-written — may contain errors; check the original before relying on it.