2026-10-22 / Signal #1
AI Found Decade-Old PHP Bugs That Can Take Over 70% of the Web
“The language that runs most of the internet just got two critical holes that AI spotted after humans missed them for a decade. Some sites chose to go dark rather than stay online.”
The Story
Researchers using GPT-5.6 Sol and Gemini 4 Argon uncovered two critical remote-code-execution flaws in PHP (nicknamed PHP2Shell) that date back to 2012 and affect every version through 8.5, powering WordPress, Drupal, and roughly 70% of websites. Emergency patches dropped Oct 21 after an early leak; the NSA told operators who cannot update immediately to take systems offline, and some government sites went dark as a precaution. OpenAI coordinated a “defender’s window” so patches and WAF rules could ship before full details became public.
Why It Matters
AI is now finding (and helping weaponize) ancient infrastructure bugs faster than humans can inventory or patch them, turning the everyday web into a live-fire exercise. The story is concrete—specific CVEs, a 14-year-old code path, sites actually going offline—not generic “AI will hack everything.
Evidence
Wiz Research blog, CNN, OpenAI Patch the Planet, PHP Foundation advisories, NSA guidance. Patches released Oct 21; exploitation attempts reported shortly after.
Sources
Daily scan: 2026-10-22