Exclusive | AI Just Found a Bug That Puts up to 70% of the World’s Websites at Risk

A facts-only brief, written by a local AI model from this article in The Wall Street Journal, October 21, 2026. It may contain mistakes, and it is not the article: the full story is at wsj.com.

The creators of PHP disclosed a critical security vulnerability named PHP2Shell on Wednesday, which allows attackers to seize control of systems running the software. The flaw, which affects up to 70% of global websites, was identified by researchers at Calif using OpenAI’s GPT-5.6 Sol model during an August audit. Volker Dusch, a security engineer for the PHP foundation, described it as the most severe issue the project has faced in over a decade, comparing its potential impact to the Heartbleed bug.

Background

• Security experts warn that AI tools could rapidly analyze patches to develop exploits, accelerating the race between defenders and attackers.
• The discovery process involved collaboration among Calif, Google’s Wiz team, and OpenAI’s research group, with the latter funding the initial audit.
• A leak on Hacker News on Tuesday forced the PHP team to release the patch ahead of the originally scheduled October 22 date.
• The remediation effort required fixing nearly 200 files and writing over 10,000 lines of code to address the memory management flaw.

Read the full article at wsj.com

More from Wednesday, October 21: