Science & Tech · AI · 3 hrs ago
AI exposes long-hidden security flaws in widely used software
AI-assisted researchers found serious flaws in PHP, a programming language used by about 70 percent of the world’s websites.
The flaws, nicknamed PHP2Shell, had been in the code for more than a decade and could allow hackers to breach systems.
Authorities urged website administrators to install emergency updates, and some government and corporate websites briefly went offline while they patched the flaws.
PHP is open-source software, meaning people can use, change and share its code; it is maintained by a nonprofit foundation with limited resources.
AI can uncover flaws that were too complicated for people to exploit, and developers are finding more security bugs in other software too.
Small teams may not have enough resources to fix vulnerabilities at this pace, even though major technology companies rely on open-source software.
The article gives no specific next step beyond the updates already made and the ongoing work to address security flaws.
Artificial intelligence helped cybersecurity experts uncover PHP2Shell vulnerabilities in the widely used PHP programming language.
The flaws had been embedded in PHP code for more than a decade and could allow hackers to breach systems.
Authorities worldwide urged website administrators to install emergency updates after the vulnerabilities were flagged.
Government and corporate websites briefly went offline while they patched the flaws.
Experts warn that AI could expose more security bugs than volunteer-supported software projects have the resources to fix.
- Who
- Independent cybersecurity experts used AI to discover the vulnerabilities; authorities urged website administrators to update their systems.
- What
- The PHP2Shell vulnerabilities could allow hackers to breach systems.
- When
- They were flagged earlier in October 2026.
- Where
- In the code of PHP, a widely used open-source web programming language.
- Why
- Advanced AI could find and exploit flaws that would have been too complicated for humans to exploit.
This story does not have two clearly opposing sides.
Danish-Canadian programmer Rasmus Lerdorf created PHP to track visits to his online resume.
The PHP Foundation was launched to coordinate PHP development.
Independent cybersecurity experts using AI discovered the PHP2Shell vulnerabilities, prompting emergency updates.
- Affected software
- PHP, an open-source web programming language
- Vulnerability name
- PHP2Shell
- PHP’s reach
- Runs about 70 percent of the world’s websites
- PHP Foundation
- Launched in 2021 to coordinate development
- Chrome security bugs
- Google uncovered more than 1,000 in its last update
What people are saying
There’s been a lot of people in the AI safety community that said this is one of the first areas where we are going to see the harmful impact of AI
It’s simply not possible with the resources in place to fix all of the known vulnerabilities
Foundations are attempting to manage these challenges, but the smaller ones don’t have hundreds of millions in funding, and managing this at the pace AI requires is proving impossible