What to know about the PHP bug affecting 70% of the world's websites

Updated on: October 22, 2026 / 3:42 PM EDT / CBS News

What to know about the PHP bug affecting 70% of the world's websites

TL;DR

  • A bug called PHP2Shell has been found in the PHP programming language, affecting up to 70% of the world's websites.
  • This vulnerability could allow hackers to take control of unprotected website servers, install malware, steal customer data, and take sites offline.
  • An OpenAI artificial intelligence model was used by researchers to help discover the flaw.
  • The potential impact is significant due to PHP's widespread use in government agencies, social media platforms, and various online services.
  • Consumers' personal information could be at risk if they have accounts with online platforms using vulnerable PHP sites.
  • AI is accelerating the ability of both vulnerability researchers and malicious actors, shortening the time between discovery and exploitation.
  • The FBI has advised organizations that cannot immediately patch to temporarily take their sites offline.
  • The PHP Foundation has released patches and instructions for updating systems.
  • The discovery underscores the ongoing battle between security professionals and hackers using AI to find and exploit technological weaknesses.