AI Just Found a Bug That Puts Up to 70% of the World’s Websites at Risk
Two critical PHP vulnerabilities dubbed PHP2Shell have prompted urgent security updates and warnings worldwide after premature disclosure. The flaws could enable remote code execution or expose sensitive server memory, potentially affecting 70% of websites. Cybersecurity agencies have urged organisations to patch vulnerable systems immediately.
Kwedu News 
Source: GroundNews
On Wednesday, October 21, organisations worldwide scrambled to address two critical PHP vulnerabilities dubbed PHP2Shell after premature online disclosure forced the PHP Foundation to release security updates ahead of schedule.
Researchers at Wiz and Calif independently identified the flaws using advanced AI tools in August, coordinating with the PHP Foundation to address code issues persisting for more than a decade.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, could allow attackers to remotely execute code or access sensitive server memory, potentially impacting roughly 70% of websites worldwide.
Several services, including Japan's Finance Ministry and the Wikimedia Foundation, went offline Wednesday as a precaution, while cybersecurity agencies CERT-EU and CERT-In advised immediate patching of vulnerable systems.
Sophos Counter Threat Unit's Don Smith warned that "threat actors move fast, especially with the help of AI," noting legacy appliances often act as a 'black box' difficult to patch or replace.
