How an OpenAI model exposed a flaw in 70% of the internet’s websites

On October 21, 2026, governments and organizations worldwide raced to address a critical security flaw in PHP, a fundamental programming language powering the internet. The vulnerability, discovered by a researcher at Calif using OpenAI's advanced AI model in August 2026, could grant hackers access to sensitive data and full control of websites.

PHP, which runs on around 70% of websites, operates on both core system components and individual scripts that process user input and produce output. This flaw, dubbed PHP2Shell, allows unauthorized commands on the host computer, leading to data access and full website control. Although the vulnerability existed for over a decade, AI's ability to analyze vast codebases at unprecedented speed made its discovery possible.

However, this dual-edged sword also means AI could be used by attackers to locate and exploit similar vulnerabilities. Organizations relying on PHP-based systems should prioritize patching to protect sensitive data and prevent disruptions, as even small sites built on popular CMS like WordPress are at risk.