Science & Tech · Cybersecurity · 9 hrs ago
AI speeds discovery of old website security flaws
In October 2026, researchers disclosed two critical flaws in PHP, the programming language used by WordPress and many other websites.
The flaws had existed for years, but AI helped researchers find them and build working exploits much faster than before.
Attackers began trying to exploit them on 17 October, before the flaws became public, and emergency updates followed on 21 October.
The attacks exposed a gap between finding a flaw and fixing it: developers, hosting providers and website owners all have roles in protecting systems.
Hosting providers usually handle server-level PHP updates on shared hosting, but website owners must update WordPress, plug-ins and themes and protect accounts and credentials.
Owners of self-managed virtual servers also need to maintain the server software themselves.
Website owners can reduce the time they remain exposed by installing updates, removing unused plug-ins, checking backups and reviewing credentials.
AI helped researchers identify two critical PHP vulnerabilities and develop working exploits more quickly, according to Wiz Research.
The flaws affected PHP, which powers WordPress and millions of other websites, and allowed attackers to run commands on vulnerable servers without logging in.
Attempts to exploit PHP2Shell were recorded from 17 October 2026, before the flaws became public.
Emergency updates followed on 21 October, and CISA confirmed active exploitation on 26 October.
AI is also being used to verify patches and identify vulnerabilities, but website owners still need to update software and address exposed risks.
- Who
- Wiz Research, attackers and website owners are central to the story.
- What
- AI helped identify two critical PHP vulnerabilities and combine them into working exploits. Attackers used the flaws to run commands on vulnerable servers without logging in.
- When
- The vulnerabilities were disclosed in October 2026; exploit attempts were recorded from 17 October.
- Where
- On vulnerable PHP servers, including websites using WordPress.
- Why
- The flaws were already present in existing software, while AI sped up finding them and developing exploits.
This story does not have two clearly opposing sides.
Attempts to exploit PHP2Shell were recorded.
Exploit details leaked.
Emergency updates followed.
CISA confirmed active exploitation.
- PHP2Shell vulnerabilities
- Two critical flaws in PHP
- Affected software
- PHP, which powers WordPress and millions of other websites
- Research speed
- One researcher completed in a week work that previously took a specialist team several months
- Exploit attempts
- Recorded from 17 October 2026
- Emergency updates
- Followed on 21 October 2026
- Active exploitation
- Confirmed by CISA on 26 October 2026
What people are saying
one researcher completed in a week what would previously have taken a specialist security team several months