Governments and organizations around the world began emergency remediation efforts on Oct. 21, 2026, after the disclosure of a vulnerability in PHP, the programming language that powers much of today's web. The bug could give hackers access to data and control of websites, prompting urgent warnings from the U.S. National Security Agency, cybersecurity agencies and software vendors.

A researcher at Calif, a security research firm, found the flaw in August 2026 using an advanced artificial intelligence model from OpenAI. The firm alerted the nonprofit that manages PHP. However, word of the flaw leaked before the PHP organization released patches for its software, and according to Amazon Web Services officials, hackers began “broadly” attempting to exploit it.

The vulnerability has implications far beyond a single company or platform, because PHP is a key piece of software that helps run millions of websites. So, what is PHP, what role did AI play in uncovering the flaw, and the average user worry?

PHP: The foundation of the web

PHP is a programming language that powers most websites. For a modern site to deliver dynamic content, visual elements and searchable features, a program must run on the web server and take user input — whether that means typing a web address or clicking links and buttons. Estimates suggest that around 70% of websites run on PHP. A weakness in PHP is therefore not a flaw in one application but in a layer shared by millions of sites at once.

PHP operates on a web server in two main parts: the core PHP system — the engine and runtime libraries — and the individual PHP scripts, the custom programs that actually implement a website. When a visitor interacts with a site, PHP scripts run, take user input and produce the output the web browser displays.

The vulnerability

The security issue sits directly in the core PHP system and the libraries it uses. When a vulnerability exists at this deep level, it can allow an adversary to exploit the underlying system. In this case, attackers can run unauthorized commands on the computer hosting a website, giving them access to data and full control of the site.

Importantly, this is not a mistake in an individual website's code. Because the issue lies in the core PHP system, every unpatched server running PHP is vulnerable. And since websites are accessible to anyone on the internet, adversaries can easily find PHP-based targets using automated tools, then run an exploit program that takes advantage of the flaw. The result is a race between administrators applying fixes and attackers scanning for servers that have not yet patched — a dynamic already visible in the broad exploitation attempts Amazon Web Services officials described.

The exploit code is called PHP2Shell, a name derived from the “shell access” it grants — a cybersecurity term for direct command-line control of the computer running a website. Shell access bypasses the website interface, giving adversaries a window to enter commands and access all of the site's data.

AI: A double-edged sword

What makes this vulnerability particularly notable is how it was discovered. The flaw came to light through coordinated disclosure, a process in which cybersecurity researchers report bugs to PHP developers before publicizing them. In this case, roughly two months separated the private report in August from the public disclosure in October.

The episode highlights the power of AI in cybersecurity. For decades, finding subtle software flaws required large teams of specialists manually reviewing code. Today's AI systems can examine vast codebases and identify unusual patterns in hours or days, analyzing millions of lines of code and spotting subtle memory-management bugs that human auditors might miss over decades of software development. The PHP vulnerability had existed in the core PHP code for more than a decade, and AI helped researchers find it. The case illustrates how the scale of vulnerability discovery is changing: a single researcher working with AI can surface bugs that once demanded large teams.

But the same tools can serve attackers. The reasoning capabilities that help security researchers find flaws first can also let adversaries rapidly scan the web for vulnerable targets and automate the creation of exploit tools. That illustrates why it is so critical for security teams to use AI to find vulnerabilities and report them safely and proactively — and why AI can also help release patches that mitigate them.

Should you worry?

Many government agencies, universities, hospitals and businesses rely on PHP-based systems. While individual internet users are unlikely to be directly affected, organizations that delay patching could expose sensitive data, risk disruption to their operations or hand attackers a foothold into larger networks.

PHP runs entirely on remote web servers. If you are an everyday internet user visiting websites, you do not need to download a patch or fix your personal computer.

However, if you manage a website, blog or server — even a small site built on popular content management systems such as WordPress, which itself runs on PHP — you should check your server administration panel or web host immediately to ensure the PHP software is updated to the latest patched version. If a third party hosts your website, check with them to confirm they have patched for these vulnerabilities.

The PHP2Shell discovery illustrates a new reality for cybersecurity. In an interconnected world, keeping web infrastructure secure is a continuous race. As AI tools become standard for both cyber defenders and online adversaries, maintaining fast patching habits remains the most essential defense.

This article was written by Doug Jacobson, University Professor of Electrical and Computer Engineering at Iowa State University. It is republished from The Conversation under a Creative Commons license; read the original article. This story was originally featured on Fortune.com.