What to know about the PHP bug affecting 70% of the world's websites
Updated on: October 22, 2026 / 3:42 PM EDT / CBS News
TL;DR
- A bug called PHP2Shell has been found in the PHP programming language, affecting up to 70% of the world's websites.
- This vulnerability could allow hackers to take control of unprotected website servers, install malware, steal customer data, and take sites offline.
- An OpenAI artificial intelligence model was used by researchers to help discover the flaw.
- The potential impact is significant due to PHP's widespread use in government agencies, social media platforms, and various online services.
- Consumers' personal information could be at risk if they have accounts with online platforms using vulnerable PHP sites.
- AI is accelerating the ability of both vulnerability researchers and malicious actors, shortening the time between discovery and exploitation.
- The FBI has advised organizations that cannot immediately patch to temporarily take their sites offline.
- The PHP Foundation has released patches and instructions for updating systems.
- The discovery underscores the ongoing battle between security professionals and hackers using AI to find and exploit technological weaknesses.