{"id":7245,"date":"2026-10-21T19:43:44","date_gmt":"2026-10-21T19:43:44","guid":{"rendered":"https:\/\/www.vaultinsider.top\/?p=7245"},"modified":"2026-10-21T19:43:44","modified_gmt":"2026-10-21T19:43:44","slug":"ai-helped-discover-the-php-vulnerability-that-could-take-down-70-of-the-internet","status":"publish","type":"post","link":"https:\/\/www.vaultinsider.top\/?p=7245","title":{"rendered":"AI helped discover the PHP vulnerability that could take down 70% of the Internet"},"content":{"rendered":"

<\/p>\n

Increasingly powerful AI tools are at the center of a new war between those who want to use them to supercharge cyberattacks, and the defenders who are harnessing the same tools to fend them off. Today, the defenders are hoping they got a leg up in identifying a critical issue that stands to take down 70% of the internet if left unaddressed.<\/p>\n

While the software flaws have now been found and patches issued, the question remains whether enough of the internet will deploy the patches in time, before hackers start exploiting the vulnerability to attack websites and steal vital data.<\/p>\n

\n

Most web pages run using an open-source programming language called PHP. That language is maintained by the PHP Foundation. Today, the foundation disclosed two \u201ccritical\u201d software vulnerabilities and issued an emergency patch, urging websites to implement it immediately or take down their websites until they are able to. The vulnerabilities are named CVE-2026-109618 and CVE-2026-109619 and collectively called \u201cphp2shell.\u201d\u00a0<\/p>\n

As reports broke overnight of the vulnerabilities ahead of the patch\u2019s official release, some opportunistic attackers tried to exploit it. Cloudflare, a global cybersecurity company that helps secure millions of websites, according to its website, began seeing \u201cearly attacks,\u201d according to its CTO Dane Knecht. While instances of successful breaches are still limited and unfolding, one startup owner reported that the PHP bug is \u201creal bad\u201d and says everyone should be \u201cafraid\u201d after hackers allegedly stole their source code, exposed cookie data, and leaked legal documents.<\/p>\n

Multiple governments have decided to take websites offline as a safety precaution, including some agencies in the Netherlands and Finland, Reuters reported. The Federal Bureau of Investigation\u2019s (FBI) Cyber Division and the National Security Agency (NSA) both issued statements urging potentially affected organizations to update their services, as did the Prime Minister of Japan, the European Union Computer Emergency Response Team (CERT), and several other national agencies.<\/p>\n

\u201cThe impact of the PHP vulnerabilities is massive, [and] can expose a large number of websites to immediate attacks if not patched in time,\u201d Gang Wang, Associate Professor of Computer Science at the University of Illinois\u2019 Grainger Engineering, told Fortune<\/em>. The bugs allow bad actors to remotely execute code on flawed, not-yet-patched PHP systems. Attackers can use that as an \u201centry point into the network hosting that machine, and from there potentially carry out attacks that cause significant damage,\u201d Wang\u2019s colleague David Nicol, Director of the Information Trust Institute at the University of Illinois\u2019 Grainger College of Engineering told Fortune<\/em>.<\/p>\n

Among the most well-known sites that run on PHP is WordPress, which powers roughly 40% of all websites, according to Reuters. But PHP is ubiquitous across the web, having started as a small project back in 1994 and grown up with the modern internet. For example, Facebook launched in 2004 as a PHP website, although in 2020 the company embarked on a major effort to update to different software. Other popular sites using PHP include Microsoft.com, Wikipedia.org, Archive.org (now temporarily offline), Theguardian.com, and Baidu.com, according to w3techs. An initial analysis by the cybersecurity firm Palo Alto Networks identified 22.6 million potentially vulnerable instances.<\/p>\n

OpenAI co-founder and president Greg Brockman said PHP was his \u201cfirst programming language,\u201d in a post about the vulnerability discovery. OpenAI\u2019s GPT-5.6 Sol model, as well as other AI tools, played a key role in finding the vulnerabilities.<\/p>\n

\u201cGiven the severity of these flaws and PHP\u2019s widespread use, we consider this one of the most impactful security issues in recent memory,\u201d OpenAI said in a blog post. \u201cIt highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits.\u201d<\/p>\n

The backstory: Three parties discovered different elements of the bug<\/h2>\n

Multiple security organizations independently found the issue around the same time, in August. All of them used AI to help find the vulnerabilities. They then banded together in a coordinated effort with the PHP Foundation to develop fixes and coordinate the disclosure of the vulnerabilities and rollout of the patch, OpenAI said.\u00a0<\/p>\n

Technically, the first to discover part of the issue was the California-based AI red-teaming firm Calif. OpenAI had invited Calif to join its Patch the Planet initiative, an effort to proactively find and patch security vulnerabilities in digital infrastructure. Calif decided to investigate PHP because it \u201cstood out as a high-impact target,\u201d the company says. It reached out to Volker Dusch at the PHP Foundation, and then \u201cgot to work hacking PHP.\u201d\u00a0<\/p>\n

The Calif team was \u201cnot expecting to find anything critical\u201d since PHP has been highly scrutinized by the cybersecurity community for years. In fact, the bug they eventually found had \u201cbeen present in PHP for 14 years,\u201d OpenAI\u2019s Brockman pointed out in his post. \u201cA limited version of it had been discovered in 2024 and wasn\u2019t considered significant at the time.\u201d But now that AI models can run attack sequences autonomously, almost no vulnerability is too difficult to exploit.<\/p>\n

\u201cPhp2shell shows how AI can help uncover buried flaws and turn complex exploit chains into practical attacks, increasing the potential risk,\u201d TJ Sayers, Senior Director of Threat Intelligence at the Center for Internet Security told Fortune<\/em>.<\/p>\n

On Aug.1, Calif found the first issue using GPT-5.6 Sol. It then informed OpenAI, which looked into the issue on its own and found additional elements of the bug. This made the discovery more comprehensive, but almost made clear that the flaw was more serious than Calif had originally realized, an OpenAI spokesperson told Fortune.<\/em><\/p>\n

Then, OpenAI began chatting with the PHP Foundation about the issue. Through those conversations, OpenAI learned that Wiz, a Google-owned cybersecurity company, was also talking to them about the issue.<\/p>\n

Researchers at Wiz had independently found the vulnerabilities in August. They decided to investigate PHP in the first place because it\u2019s \u201cthe backbone of the internet,\u201d a Wiz spokesperson tells Fortune<\/em>, acknowledging that the parallel initiative may seem like a \u201ccoincidence,\u201d but the Wiz team\u2019s charter is to investigate high-impact digital infrastructure, and PHP was top of mind. The Wiz team identified the first issue on Aug. 19, using a combination of Google\u2019s Gemini 4 Argon, OpenAI\u2019s GPT-5.6 Sol, and Wiz Atlas.<\/p>\n

\u201cWith 70% of the Internet affected, the impact of php2shell cannot be overstated,\u201d Wiz said in a blog post announcing its findings. \u201cIt marks an AI inflection point. The vulnerable code had been there for more than a decade\u2013what AI changed was the ability to understand the weaknesses and turn them into a working exploit.\u201d<\/p>\n

OpenAI then decided to bring all the parties together, leading a \u201ccoalition of maintainers, researchers, and security providers to address [the] critical vulnerabilities,\u201d the company said. That included Wiz, Calif, PHP, Cloudflare, and multiple U.S. government agencies, among others. Cloudlfare\u2019s blog post also names the French cybersecurity company Quarkslab as part of the effort.<\/p>\n<\/div>\n

#helped #discover #PHP #vulnerability #Internet<\/p>\n","protected":false},"excerpt":{"rendered":"

Increasingly powerful AI tools… <\/p>\n","protected":false},"author":1,"featured_media":7246,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[828,8780,1303,990,7043,813,992,2971,936,830,480,10332,8404],"class_list":["post-7245","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-finance-news","tag-ai-agents","tag-cloudflare","tag-cyber","tag-data-security","tag-discover","tag-hack","tag-hackers","tag-hacks","tag-helped","tag-internet","tag-openai","tag-php","tag-vulnerability"],"yoast_head":"\nAI helped discover the PHP vulnerability that could take down 70% of the Internet - Finance News<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.vaultinsider.top\/?p=7245\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"AI helped discover the PHP vulnerability that could take down 70% of the Internet - Finance News\" \/>\n<meta property=\"og:description\" content=\"Increasingly powerful AI tools…\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.vaultinsider.top\/?p=7245\" \/>\n<meta property=\"og:site_name\" content=\"Finance News\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-21T19:43:44+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/fortune.com\/img-assets\/wp-content\/uploads\/2026\/10\/GettyImages-2277432403-e1792606578963.jpg?w=2048\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/?p=7245#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/?p=7245\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/#\\\/schema\\\/person\\\/ed40724a3e5d482ce66781a042c3c31e\"},\"headline\":\"AI helped discover the PHP vulnerability that could take down 70% of the Internet\",\"datePublished\":\"2026-10-21T19:43:44+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/?p=7245\"},\"wordCount\":1164,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/?p=7245#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.vaultinsider.top\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/GettyImages-2277432403-e1792606578963.jpg\",\"keywords\":[\"AI agents\",\"Cloudflare\",\"cyber\",\"Data Security\",\"Discover\",\"hack\",\"Hackers\",\"hacks\",\"helped\",\"Internet\",\"OpenAI\",\"PHP\",\"vulnerability\"],\"articleSection\":[\"Finance News\"],\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.vaultinsider.top\\\/?p=7245#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/?p=7245\",\"url\":\"https:\\\/\\\/www.vaultinsider.top\\\/?p=7245\",\"name\":\"AI helped discover the PHP vulnerability that could take down 70% of the Internet - Finance News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/?p=7245#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/?p=7245#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.vaultinsider.top\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/GettyImages-2277432403-e1792606578963.jpg\",\"datePublished\":\"2026-10-21T19:43:44+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/#\\\/schema\\\/person\\\/ed40724a3e5d482ce66781a042c3c31e\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/?p=7245#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.vaultinsider.top\\\/?p=7245\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/?p=7245#primaryimage\",\"url\":\"https:\\\/\\\/www.vaultinsider.top\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/GettyImages-2277432403-e1792606578963.jpg\",\"contentUrl\":\"https:\\\/\\\/www.vaultinsider.top\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/GettyImages-2277432403-e1792606578963.jpg\",\"width\":1200,\"height\":600},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/?p=7245#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\\\/\\\/www.vaultinsider.top\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"AI helped discover the PHP vulnerability that could take down 70% of the Internet\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/#website\",\"url\":\"https:\\\/\\\/www.vaultinsider.top\\\/\",\"name\":\"Finance News\",\"description\":\"Just another Finance News site\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.vaultinsider.top\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/#\\\/schema\\\/person\\\/ed40724a3e5d482ce66781a042c3c31e\",\"name\":\"admin\",\"url\":\"https:\\\/\\\/www.vaultinsider.top\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"AI helped discover the PHP vulnerability that could take down 70% of the Internet - Finance News","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.vaultinsider.top\/?p=7245","og_locale":"zh_CN","og_type":"article","og_title":"AI helped discover the PHP vulnerability that could take down 70% of the Internet - Finance News","og_description":"Increasingly powerful AI tools…","og_url":"https:\/\/www.vaultinsider.top\/?p=7245","og_site_name":"Finance News","article_published_time":"2026-10-21T19:43:44+00:00","og_image":[{"url":"https:\/\/fortune.com\/img-assets\/wp-content\/uploads\/2026\/10\/GettyImages-2277432403-e1792606578963.jpg?w=2048","type":"","width":"","height":""}],"author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"6 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.vaultinsider.top\/?p=7245#article","isPartOf":{"@id":"https:\/\/www.vaultinsider.top\/?p=7245"},"author":{"name":"admin","@id":"https:\/\/www.vaultinsider.top\/#\/schema\/person\/ed40724a3e5d482ce66781a042c3c31e"},"headline":"AI helped discover the PHP vulnerability that could take down 70% of the Internet","datePublished":"2026-10-21T19:43:44+00:00","mainEntityOfPage":{"@id":"https:\/\/www.vaultinsider.top\/?p=7245"},"wordCount":1164,"commentCount":0,"image":{"@id":"https:\/\/www.vaultinsider.top\/?p=7245#primaryimage"},"thumbnailUrl":"https:\/\/www.vaultinsider.top\/wp-content\/uploads\/2026\/10\/GettyImages-2277432403-e1792606578963.jpg","keywords":["AI agents","Cloudflare","cyber","Data Security","Discover","hack","Hackers","hacks","helped","Internet","OpenAI","PHP","vulnerability"],"articleSection":["Finance News"],"inLanguage":"zh-Hans","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.vaultinsider.top\/?p=7245#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.vaultinsider.top\/?p=7245","url":"https:\/\/www.vaultinsider.top\/?p=7245","name":"AI helped discover the PHP vulnerability that could take down 70% of the Internet - Finance News","isPartOf":{"@id":"https:\/\/www.vaultinsider.top\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.vaultinsider.top\/?p=7245#primaryimage"},"image":{"@id":"https:\/\/www.vaultinsider.top\/?p=7245#primaryimage"},"thumbnailUrl":"https:\/\/www.vaultinsider.top\/wp-content\/uploads\/2026\/10\/GettyImages-2277432403-e1792606578963.jpg","datePublished":"2026-10-21T19:43:44+00:00","author":{"@id":"https:\/\/www.vaultinsider.top\/#\/schema\/person\/ed40724a3e5d482ce66781a042c3c31e"},"breadcrumb":{"@id":"https:\/\/www.vaultinsider.top\/?p=7245#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.vaultinsider.top\/?p=7245"]}]},{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.vaultinsider.top\/?p=7245#primaryimage","url":"https:\/\/www.vaultinsider.top\/wp-content\/uploads\/2026\/10\/GettyImages-2277432403-e1792606578963.jpg","contentUrl":"https:\/\/www.vaultinsider.top\/wp-content\/uploads\/2026\/10\/GettyImages-2277432403-e1792606578963.jpg","width":1200,"height":600},{"@type":"BreadcrumbList","@id":"https:\/\/www.vaultinsider.top\/?p=7245#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.vaultinsider.top\/"},{"@type":"ListItem","position":2,"name":"AI helped discover the PHP vulnerability that could take down 70% of the Internet"}]},{"@type":"WebSite","@id":"https:\/\/www.vaultinsider.top\/#website","url":"https:\/\/www.vaultinsider.top\/","name":"Finance News","description":"Just another Finance News site","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.vaultinsider.top\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.vaultinsider.top\/#\/schema\/person\/ed40724a3e5d482ce66781a042c3c31e","name":"admin","url":"https:\/\/www.vaultinsider.top\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/www.vaultinsider.top\/index.php?rest_route=\/wp\/v2\/posts\/7245","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.vaultinsider.top\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.vaultinsider.top\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.vaultinsider.top\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.vaultinsider.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=7245"}],"version-history":[{"count":0,"href":"https:\/\/www.vaultinsider.top\/index.php?rest_route=\/wp\/v2\/posts\/7245\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.vaultinsider.top\/index.php?rest_route=\/wp\/v2\/media\/7246"}],"wp:attachment":[{"href":"https:\/\/www.vaultinsider.top\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7245"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.vaultinsider.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7245"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.vaultinsider.top\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7245"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}