AI Helped Find a Huge Hole in the Code Behind Most Websites. Here’s What It Means for You

As an Amazon Associate we earn from qualifying purchases. Learn more about our affiliate links

The short version: On Wednesday, October 21, 2026, the people who maintain PHP, the behind-the-scenes code that runs roughly 7 out of 10 websites, rushed out fixes for two very serious security holes. The bugs, nicknamed PHP2Shell, were found with help from AI. Within hours, websites around the world, from DeviantArt to the Internet Archive to government sites, went offline for a while to patch up. The good news: most regular people don’t need to do anything. The people who need to act are website owners. Here’s what happened, in plain English.

First, a quick vocabulary check

PHP is a programming language, a set of instructions computers understand. It quietly powers a huge share of the web, including WordPress, the tool behind millions of blogs and small business sites. You never see it. It works in the back room, like the kitchen of a restaurant.
A server is the computer, usually sitting in a big warehouse somewhere, that holds a website and sends it to your screen.
A vulnerability (or “security hole”) is a mistake in software that a bad guy could use to break in.
A patch is the fix. Think of it as the repair crew showing up with a new lock.
“Shell” is techie slang for full control of a computer. “PHP2Shell” means a hole in PHP that could let an attacker take over the server. That’s why everyone moved so fast.

What actually happened

Two flaws, with the official tracking numbers CVE-2026-109618 and CVE-2026-109619, were rated 9.2 out of 10 for severity. According to security company Tenable, every version of PHP going back to version 5.4 from 2012 is affected by at least one of them. In the worst case, an attacker could send a specially made request to a website and run their own commands on its server, without needing a password.

The fixes came out on October 21 as PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The release was even moved up a day after the bug numbers leaked early. Older versions (PHP 8.1 and below) are past their official support dates, so they didn’t get an official update. Owners of those sites are basically being told: upgrade, or protect it some other way.

Where AI comes in

This is the part that makes it AI news. Two separate teams found the bugs, and both had AI helpers in the passenger seat:

A researcher at a security firm called Calif found them using an OpenAI model through an OpenAI program called “Patch the Planet,” which puts AI to work hunting for bugs in widely used software.
Cloud security company Wiz found both flaws on its own, using its AI security system along with AI models from Google and OpenAI. Wiz said building the full attack was “at the edge of what human researchers could practically achieve,” and called it “among the most severe vulnerabilities discovered” in software history.

OpenAI called PHP2Shell “one of the most impactful security issues in recent memory.” It also warned that it expects the number of AI-found bugs to “increase sharply in the coming months.” Translation: AI is getting very good at spotting weak spots in code. That’s great when the good guys find them first, like they did here, and a little nerve-racking when you think about who else has these tools.

Why websites went dark

Government security agencies didn’t mince words. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) told organizations to patch immediately, or take affected systems offline until they could. Similar warnings came from the NSA and the UK’s National Cyber Security Centre.

So a lot of websites pulled the plug for a bit. Over the next day or so, outages or maintenance pages showed up at Wikimedia, DeviantArt, the Internet Archive, Pokémon Home, some BBC pages, and government websites in Finland, the Netherlands, and Scotland, according to the BBC and The Verge. A couple of older online games in Japan even announced they’d shut down for good rather than fix their aging code.

Meanwhile, the bad guys got busy. Cloudflare, a company that sits in front of millions of websites to protect them, said attack attempts jumped from thousands to millions within hours of the news. Cloudflare turned on extra protection for all its customers, including free ones, to buy time. As of the latest reports, the PHP Foundation (the group that looks after PHP) said it didn’t know of any successful break-ins using these bugs, but security firms say attackers are actively trying.

What this means for you

If you just use websites, you probably don’t need to do anything. This is a bug in the websites’ computers, not in your phone or laptop. There’s no app to update on your end.
If a site you like is down, give it time. A “down for maintenance” page this week likely means the owners are doing the responsible thing.
Watch for “please change your password” emails from real companies. If a site you use tells you it was affected, change that password, and change it anywhere else you used the same one. Go to the site yourself instead of clicking the email link.
Be extra careful with scary emails about this news. Scammers love a headline. Ignore messages that say “Your account was hacked by PHP2Shell, click here.” Not sure about a message? Here’s how to ask AI if a text or email is a scam.
If you own a website (a blog, a shop, a church or club site), ask your hosting company or web person one question: “Have you updated PHP for the PHP2Shell fixes from October 21?” Updating WordPress or your plugins does not fix this one. It has to be fixed on the server, which is usually your host’s job.
It’s a great week for a security tune-up. Our new 20-minute online security checkup with free AI walks you through the basics, step by step.

Try this next

Want to stay a step ahead of the bad guys? Learn how Android’s AI can flag scam texts and calls, or read why some websites are blocking AI agents.

Common questions

What is PHP2Shell?

PHP2Shell is the nickname for two critical security flaws (CVE-2026-109618 and CVE-2026-109619) in PHP, the programming language that runs a large share of websites, including WordPress sites. In the worst case, they could let an attacker take control of a website’s server. Fixes were released on October 21, 2026.

Do I need to do anything about PHP2Shell?

Most people who just visit websites don’t need to do anything, because the flaw is on websites’ servers, not your devices. Do change your password if a company tells you it was affected, and watch out for scam emails that use the news. Website owners should ask their host if PHP has been updated.

Will updating WordPress fix PHP2Shell?

No. PHP2Shell is a flaw in PHP itself, which runs underneath WordPress on the server. Updating WordPress or plugins won’t fix it. Your hosting company or web developer needs to update PHP to a fixed version (8.5.12, 8.4.27, 8.3.36 or 8.2.35) or newer.

How did AI help find the PHP flaws?

Two teams found the bugs separately. A researcher at the security firm Calif used an OpenAI model through OpenAI’s Patch the Planet program, and the cloud security company Wiz used its own AI system along with Google and OpenAI models. Both reported the bugs privately so they could be fixed before details went public.

Why were so many websites down this week?

U.S. and UK security agencies told organizations to install the PHP fixes right away or take affected systems offline. Many sites, including DeviantArt, the Internet Archive and some government sites, went offline for a while to patch, while attackers began scanning the web for sites that hadn’t been fixed yet.

Want tech that makes everyday life easier?

We rounded up 27 unusual, well-reviewed gadgets that use AI to do something genuinely useful, explained in plain English.

See our Tech Picks