# PHP discloses PHP2Shell vulnerability affecting up to 70% of websites

Digest AI · Research · published 2026-10-21T14:06:37Z

Canonical: https://digestai.news/story/php-discloses-php2shell-vulnerability-affecting-up-to-70-of-websites

## Summary

The PHP development team announced a critical memory‑management flaw called PHP2Shell that could affect up to 70% of websites, according to the Wall Street Journal. The bug was uncovered in August with the help of the GPT‑5.6 Sol model, marking one of the most severe online security issues identified by AI tools.

Cybersecurity experts are now racing to develop and deploy patches before malicious actors exploit the flaw using AI. The report highlights both the power of generative models in finding hidden bugs and the emerging risk that the same technology could be turned against vulnerable systems.

PHP has urged site owners to monitor updates and apply fixes as soon as they become available, while the broader community watches how AI‑assisted discovery may reshape vulnerability research and defense strategies.

## Key points

- PHP announced a memory‑management flaw called PHP2Shell that could affect up to 70% of websites.
- The vulnerability was identified in August using the GPT‑5.6 Sol model.
- Experts are urging rapid patches to prevent AI‑assisted exploitation.

## Why it matters

A flaw that may compromise the majority of web sites poses a massive security risk, and its AI‑driven discovery underscores both the promise and danger of using generative models for vulnerability research.

## Sources

1. [PHP discloses a critical memory-management vulnerability, dubbed "PHP2Shell", that affects up to 70% of websites, discovered using GPT-5.6 Sol in August](https://wsj.com/tech/cybersecurity/ai-just-found-a-bug-that-puts-up-to-70-of-the-worlds-websites-at-risk-fd0902ea?st=tBLRBh&reflink=desktopwebshare_permalink) (wsj.com, 2026-10-21)
2. [PHP2Shell: AI uncovers critical RCE in PHP](https://wiz.io/blog/php2shell-php-rce) (wiz.io, 2026-10-21)
3. [GPT‐5.6 Sol was used to identify critical PHP flaw.](https://theverge.com/tech/1015481/gpt-5-6-sol-was-used-to-identify-critical-php-flaw) (theverge.com, 2026-10-21)

## Cite

Digest AI, "PHP discloses PHP2Shell vulnerability affecting up to 70% of websites", 21 October 2026, https://digestai.news/story/php-discloses-php2shell-vulnerability-affecting-up-to-70-of-websites

---

Written by Digest AI's editorial model from the linked sources; the sources are the record. Headlines, digests and key points are written by Digest AI and may be quoted with a link to the story page. Linked articles belong to their publishers. Terms: https://digestai.news/terms#reuse
JSON: https://digestai.news/story/php-discloses-php2shell-vulnerability-affecting-up-to-70-of-websites.json