OpenAI Tech Discovers Critical PHP Vulnerabilities, Triggering Global Cybersecurity Response

AI researchers identified two critical PHP vulnerabilities that could let attackers gain unauthorized control of website servers. OpenAI technology helped researchers discover the flaws. Cybersecurity firms named the flaws "php2shell". Attackers could exploit the vulnerabilities to steal sensitive information, including passwords and other data.

A potential attack exploiting PHP flaws emerged on Wednesday. Governments and companies temporarily disabled websites while installing security patches. Dozens of websites across the U.S., U.K. and other countries briefly went offline for the fixes. The disruption alerted the National Security Agency and Europe's cybersecurity agency. Security patches became available on Oct. 21, 2026. Cybersecurity firms urged all PHP users to install the updates immediately.

OpenAI described the discovery as "one of the most impactful security issues in recent memory." OpenAI said that, to the company's knowledge, frontier AI discovered the vulnerabilities before attackers did. Cybersecurity firm Wiz ranked the findings among PHP's most severe vulnerabilities and arguably among the worst in software history. Wiz said the flaws escaped detection for more than a decade because exploitation required complex technical work that AI helped researchers identify. Everyday websites may consequently have remained exposed to hackers for years.

PHP, short for Hypertext Preprocessor, is a programming language that powers millions of websites. PHP serves roughly 70% of websites for which the server-side programming language is known. PHP has helped developers build websites since the 1990s. PHP collects information and produces content for browsers, while HTML defines the content a website displays. Websites using PHP include Wikipedia, WordPress blogs and online shopping sites.

Bradley Olson said the PHP vulnerabilities were serious enough that the NSA advised website operators to disable sites if operators lacked time to install patches. Recent cybersecurity incidents have also disrupted developer platforms, exposed public-school data and involved intrusions at public companies. Banks are detecting unauthorized access by third-party agents within customer accounts and are working urgently to contain the problem.

Cybersecurity professionals have named the series of attacks "Black October" because of the number of incidents and the risks involved. However, many organizations have so far reduced the risks and prevented major real-world harm. Defenders and AI companies have spent months warning that a period of cybersecurity emergencies was imminent. Defenders and AI companies have also worked to secure little-known software that supports much of the modern internet. Experts have urged users to protect passwords, use a password manager and avoid panic as attacks continue.