OpenAI and Calif Reveal Major PHP Vulnerabilities Affecting 70% of Websites

The PHP2Shell vulnerabilities expose a critical risk to the vast majority of websites, necessitating urgent updates to maintain security integrity.

• On October 21, 2026, researchers disclosed severe vulnerabilities in PHP, impacting around 70% of websites globally.
• The vulnerabilities, known as PHP2Shell, allow attackers to execute arbitrary code and access server memory.
• A coordinated response led to an expedited patch release on October 22, 2026, following a partial information leak.

• PHP's prevalence: Approximately 70% of websites are powered by PHP, making these vulnerabilities particularly concerning for web security.
• AI's role: The use of OpenAI's GPT-5.6 Sol model in identifying these flaws highlights the dual-edged nature of AI in cybersecurity—enhancing both defense and potential attack capabilities.
• Historical vulnerabilities: Previous PHP vulnerabilities have underscored the risks associated with open-source projects, particularly those maintained by volunteers.

In August 2026, researchers from the security firm Calif utilized OpenAI's GPT-5.6 Sol model during a code audit to uncover critical vulnerabilities in PHP, collectively termed PHP2Shell. This discovery was significant, given PHP's foundational role in web development, powering an estimated 70% of all websites. The vulnerabilities allow attackers to execute arbitrary code, posing a severe risk to server integrity and data security.

The process began when Calif's CEO, Thai Duong, notified PHP maintainer Volker Dusch on August 11, 2026, about the vulnerabilities. This initiated a coordinated remediation effort involving additional researchers, security firms like Wiz, and U.S. government agencies, including the Cybersecurity and Infrastructure Security Agency (CISA). OpenAI independently verified aspects of the vulnerabilities in September, showcasing the collaborative nature of modern cybersecurity efforts.

However, a partial leak of information about the vulnerabilities prompted an expedited public disclosure on October 21, 2026. The following day, a patch was released for supported PHP versions, urging website operators to update immediately. This rapid response was crucial, as it mitigated the risk of widespread exploitation in the wild, which had not been reported immediately following the disclosure.

The event also marked the launch of OpenAI's Patch the Planet initiative, which commits $1 billion in subsidized AI access for defenders. This initiative aims to bolster cybersecurity efforts, particularly for open-source projects that often lack adequate funding and resources for maintenance. The vulnerabilities highlighted the need for improved funding and support for open-source software, which is critical to the infrastructure of the internet.

As organizations scramble to apply the patch, discussions are emerging about the accelerated adoption of AI in security measures and the importance of maintaining robust open-source projects. The PHP2Shell vulnerabilities serve as a reminder of the ongoing challenges in cybersecurity and the need for vigilance in an increasingly complex digital landscape.

• Web developers: Immediate need to update PHP versions to secure applications.
• Website owners: Risk of data breaches and operational disruptions if vulnerabilities are exploited.
• Cybersecurity professionals: Increased demand for security audits and vulnerability assessments.
• Open-source contributors: Heightened awareness of the need for funding and resources to maintain software integrity.
• Government agencies: Pressure to enhance cybersecurity measures and public awareness campaigns.

• Patch adoption rates: Monitoring how quickly websites implement the PHP patch will indicate the overall security posture of the web.
• Exploitation attempts: Watch for any reports of exploitation in the wild, which could signal a need for further protective measures.
• AI in cybersecurity: The evolution of AI tools in vulnerability detection and response will shape future security strategies and funding discussions.