PHP is in the foundation of 70% of websites – here’s what it is and why a flaw in the software is a major hacking threat

PHP, a programming language that underpins a significant portion of the internet, found itself at the center of a security crisis on October 21, 2026. A critical flaw in the PHP core system, which powers approximately 70% of websites, was discovered by a researcher at Calif, a security research firm. This vulnerability, dubbed PHP2Shell, poses a significant threat as it allows hackers to gain unauthorized command-line access to the servers hosting the websites, potentially leading to data theft and full control of the website.

The discovery of this flaw was aided by the application of artificial intelligence, which can quickly analyze vast codebases and identify subtle security issues that might be overlooked by human auditors. Once discovered, the flaw was reported to PHP developers through a process known as coordinated disclosure. However, the PHP organization released patches for the software before this information was widely disseminated, allowing hackers to exploit the vulnerability broadly.

A direct quote from the source, "This exploit gives the attacker 'shell access,' a cybersecurity term for direct command-line control of the computer running the website. Shell access bypasses the website interface, giving adversaries a window to enter commands and access all the website’s data." highlights the severity of the situation.

While everyday internet users are unlikely to be directly impacted, organizations using PHP-based systems for their services may face serious consequences if they fail to patch the system promptly. This incident serves as a stark reminder of the ongoing need for vigilance in the cybersecurity landscape, as AI tools become increasingly integral to both identifying and exploiting vulnerabilities.